CVE-2024-46717 (GCVE-0-2024-46717)
Vulnerability from cvelistv5
Published
2024-09-18 06:32
Modified
2026-08-05 11:38
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1) No skb created yet 2) header_size == 0 (no SHAMPO header) 3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the last page fragment of a SHAMPO header page) a new skb is formed with a page that is NOT a SHAMPO header page (it is a regular data page). Further down in the same function (mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from header_index is released. This is wrong and it leads to SHAMPO header pages being released more than once.
References
Impacted products
Vendor Product Version
Linux Linux Version: 7957837b816f11eecb9146235bb0715478f4c81f
Version: 7957837b816f11eecb9146235bb0715478f4c81f
Version: 7957837b816f11eecb9146235bb0715478f4c81f
Version: 7957837b816f11eecb9146235bb0715478f4c81f
Version: a4161e4861132d5b324746a260283e87f2d65daf
Version: 5.16.6   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46717",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:57:52.467181Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:58:07.696Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:16:49.634Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "03924d117625ecb10ee3c9b65930bcb2c37ae629",
              "status": "affected",
              "version": "7957837b816f11eecb9146235bb0715478f4c81f",
              "versionType": "git"
            },
            {
              "lessThan": "ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab",
              "status": "affected",
              "version": "7957837b816f11eecb9146235bb0715478f4c81f",
              "versionType": "git"
            },
            {
              "lessThan": "c909ab41df2b09cde919801c7a7b6bb2cc37ea22",
              "status": "affected",
              "version": "7957837b816f11eecb9146235bb0715478f4c81f",
              "versionType": "git"
            },
            {
              "lessThan": "70bd03b89f20b9bbe51a7f73c4950565a17a45f7",
              "status": "affected",
              "version": "7957837b816f11eecb9146235bb0715478f4c81f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a4161e4861132d5b324746a260283e87f2d65daf",
              "versionType": "git"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.109",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.50",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.9",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: SHAMPO, Fix incorrect page release\n\nUnder the following conditions:\n1) No skb created yet\n2) header_size == 0 (no SHAMPO header)\n3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the\n   last page fragment of a SHAMPO header page)\n\na new skb is formed with a page that is NOT a SHAMPO header page (it\nis a regular data page). Further down in the same function\n(mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from\nheader_index is released. This is wrong and it leads to SHAMPO header\npages being released more than once."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the mlx5e RX completion handler, driven purely by inbound Ethernet/IP frames processed in NAPI softirq context; any remote host that can send packets to an mlx5 NIC (the standard NIC on internet-facing cloud, datacenter and HPC servers) reaches it. No local access or LAN adjacency is required since ordinary routed IP traffic produces the non-splittable-header CQEs that trigger the bug.\nAC:L - The attacker controls the entire packet stream and thus all three trigger conditions \u2014 no in-flight GRO skb, header_size == 0, and header_index landing on a page boundary (1 in every 16 entries) \u2014 so at any meaningful traffic rate the condition is hit continuously and repeatably, with no race or memory layout outside attacker influence. SHAMPO/HW-GRO must be enabled on the interface, but that is a common datacenter performance configuration rather than a rare kernel config.\nPR:N - The bug is hit in the driver receive path before any socket lookup, credential check, or authentication; the attacker needs no account, capability, or session on the target. Merely sending packets to the host\u0027s mlx5 interface is sufficient.\nUI:N - Exploitation requires only that the target receive packets on an mlx5 interface with HW-GRO active; no victim action of any kind is needed.\nS:U - The premature page release, double free, and DMA-into-freed-page all corrupt kernel memory within the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed by the defect itself.\nC:H - The page-pool double-release causes pages still referenced by live skbs to be recycled and handed to other consumers, and pages reused for unrelated kernel allocations can be re-wrapped into skbs delivered to sockets, disclosing arbitrary kernel memory to a network reader. Any use-after-free of this kind gives a general read primitive.\nI:H - The NIC\u0027s header-buffer MKEY still maps the released page, so the device keeps DMA\u0027ing fully attacker-controlled packet-header bytes into memory that has been returned to the page pool and potentially reallocated for arbitrary kernel use, and the double free lets the same page be owned by two consumers. That is an attacker-controlled write into reused kernel memory, exploitable for control-flow hijack.\nA:H - The second release triggers a page_pool refcount underflow WARN_ON (panic under panic_on_warn) and a double free into the page pool, plus header-ring bitmap/pi-ci desync that wedges the RX queue, with the use-after-free itself producing oopses. The condition is remotely and repeatedly triggerable, so a crash is readily achievable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:08.486Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/03924d117625ecb10ee3c9b65930bcb2c37ae629"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/c909ab41df2b09cde919801c7a7b6bb2cc37ea22"
        },
        {
          "url": "https://git.kernel.org/stable/c/70bd03b89f20b9bbe51a7f73c4950565a17a45f7"
        }
      ],
      "title": "net/mlx5e: SHAMPO, Fix incorrect page release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46717",
    "datePublished": "2024-09-18T06:32:16.791Z",
    "dateReserved": "2024-09-11T15:12:18.254Z",
    "dateUpdated": "2026-08-05T11:38:08.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:16:49.634Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46717\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:57:52.467181Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:57:56.549Z\"}}], \"cna\": {\"title\": \"net/mlx5e: SHAMPO, Fix incorrect page release\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7957837b816f11eecb9146235bb0715478f4c81f\", \"lessThan\": \"03924d117625ecb10ee3c9b65930bcb2c37ae629\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7957837b816f11eecb9146235bb0715478f4c81f\", \"lessThan\": \"ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7957837b816f11eecb9146235bb0715478f4c81f\", \"lessThan\": \"c909ab41df2b09cde919801c7a7b6bb2cc37ea22\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7957837b816f11eecb9146235bb0715478f4c81f\", \"lessThan\": \"70bd03b89f20b9bbe51a7f73c4950565a17a45f7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a4161e4861132d5b324746a260283e87f2d65daf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.16.6\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.109\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.50\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/03924d117625ecb10ee3c9b65930bcb2c37ae629\"}, {\"url\": \"https://git.kernel.org/stable/c/ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab\"}, {\"url\": \"https://git.kernel.org/stable/c/c909ab41df2b09cde919801c7a7b6bb2cc37ea22\"}, {\"url\": \"https://git.kernel.org/stable/c/70bd03b89f20b9bbe51a7f73c4950565a17a45f7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: SHAMPO, Fix incorrect page release\\n\\nUnder the following conditions:\\n1) No skb created yet\\n2) header_size == 0 (no SHAMPO header)\\n3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the\\n   last page fragment of a SHAMPO header page)\\n\\na new skb is formed with a page that is NOT a SHAMPO header page (it\\nis a regular data page). Further down in the same function\\n(mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from\\nheader_index is released. This is wrong and it leads to SHAMPO header\\npages being released more than once.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.109\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.50\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.9\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.16.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:53:27.973Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46717\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:53:27.973Z\", \"dateReserved\": \"2024-09-11T15:12:18.254Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-18T06:32:16.791Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.