CVE-2024-46834 (GCVE-0-2024-46834)
Vulnerability from cvelistv5
Published
2024-09-27 12:39
Modified
2026-08-05 11:38
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ethtool: fail closed if we can't get max channel used in indirection tables Commit 0d1b7d6c9274 ("bnxt: fix crashes when reducing ring count with active RSS contexts") proves that allowing indirection table to contain channels with out of bounds IDs may lead to crashes. Currently the max channel check in the core gets skipped if driver can't fetch the indirection table or when we can't allocate memory. Both of those conditions should be extremely rare but if they do happen we should try to be safe and fail the channel change.
References
Impacted products
Vendor Product Version
Linux Linux Version: d4ab4286276fcd6c155bafdf4422b712068d2516
Version: d4ab4286276fcd6c155bafdf4422b712068d2516
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46834",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:03:28.433366Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:03:33.146Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ethtool/channels.c",
            "net/ethtool/common.c",
            "net/ethtool/common.h",
            "net/ethtool/ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "101737d8b88dbd4be6010bac398fe810f1950036",
              "status": "affected",
              "version": "d4ab4286276fcd6c155bafdf4422b712068d2516",
              "versionType": "git"
            },
            {
              "lessThan": "2899d58462ba868287d6ff3acad3675e7adf934f",
              "status": "affected",
              "version": "d4ab4286276fcd6c155bafdf4422b712068d2516",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ethtool/channels.c",
            "net/ethtool/common.c",
            "net/ethtool/common.h",
            "net/ethtool/ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: fail closed if we can\u0027t get max channel used in indirection tables\n\nCommit 0d1b7d6c9274 (\"bnxt: fix crashes when reducing ring count with\nactive RSS contexts\") proves that allowing indirection table to contain\nchannels with out of bounds IDs may lead to crashes. Currently the\nmax channel check in the core gets skipped if driver can\u0027t fetch\nthe indirection table or when we can\u0027t allocate memory.\n\nBoth of those conditions should be extremely rare but if they do\nhappen we should try to be safe and fail the channel change."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only through the ethtool ioctl (`SIOCETHTOOL`/`ETHTOOL_SCHANNELS`) or the ethtool generic-netlink socket (`ETHTOOL_MSG_CHANNELS_SET`), both of which require a local process on the machine. No remote peer input reaches this code.\nAC:L - The attacker fully controls the indirection table contents and the channel-reduction request, and the only uncontrolled element \u2014 the helper returning an error \u2014 is attacker-influenceable via heap exhaustion against the `GFP_USER`/`GFP_KERNEL` allocations or by racing a device reset, and the operation can be retried in a tight loop until it lands.\nPR:L - Both entry points gate on `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`, a namespaced check, so an unprivileged user holding CAP_NET_ADMIN over a network namespace containing an RSS-capable netdev (the standard SR-IOV VF-in-container deployment) qualifies. No real root in the initial namespace is needed.\nUI:N - The attacker performs every step \u2014 setting the RSS indirection table and issuing the channel change \u2014 with no action by any other user or administrator.\nS:U - The out-of-bounds access occurs in kernel heap memory within the same kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The stale indirection entries drive an out-of-bounds read of an array of large per-ring structures at an attacker-chosen index (`bp-\u003erx_ring[j]` in `bnxt_fill_hw_rss_tbl_p5()`), reaching far beyond the allocation rather than a few bounded bytes, and the leaked values are pushed into the NIC\u0027s hardware RSS configuration.\nI:H - Out-of-bounds heap data is programmed as firmware ring identifiers into the device\u0027s RSS indirection table, causing the NIC to DMA received packets into rings that no longer exist or are no longer owned by that context \u2014 device-side memory corruption leveraged from an attacker-controlled index.\nA:H - The referenced bnxt commit documents outright crashes (\"fix crashes when reducing ring count with active RSS contexts\") with a KASAN slab-out-of-bounds splat during `__bnxt_open_nic()`, and misprogramming the hardware RSS table also breaks receive processing on the interface."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:54.577Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/101737d8b88dbd4be6010bac398fe810f1950036"
        },
        {
          "url": "https://git.kernel.org/stable/c/2899d58462ba868287d6ff3acad3675e7adf934f"
        }
      ],
      "title": "ethtool: fail closed if we can\u0027t get max channel used in indirection tables",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46834",
    "datePublished": "2024-09-27T12:39:31.110Z",
    "dateReserved": "2024-09-11T15:12:18.287Z",
    "dateUpdated": "2026-08-05T11:38:54.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46834\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:03:28.433366Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:03:29.519Z\"}}], \"cna\": {\"title\": \"ethtool: fail closed if we can\u0027t get max channel used in indirection tables\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d4ab4286276fcd6c155bafdf4422b712068d2516\", \"lessThan\": \"101737d8b88dbd4be6010bac398fe810f1950036\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d4ab4286276fcd6c155bafdf4422b712068d2516\", \"lessThan\": \"2899d58462ba868287d6ff3acad3675e7adf934f\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ethtool/channels.c\", \"net/ethtool/common.c\", \"net/ethtool/common.h\", \"net/ethtool/ioctl.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ethtool/channels.c\", \"net/ethtool/common.c\", \"net/ethtool/common.h\", \"net/ethtool/ioctl.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/101737d8b88dbd4be6010bac398fe810f1950036\"}, {\"url\": \"https://git.kernel.org/stable/c/2899d58462ba868287d6ff3acad3675e7adf934f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nethtool: fail closed if we can\u0027t get max channel used in indirection tables\\n\\nCommit 0d1b7d6c9274 (\\\"bnxt: fix crashes when reducing ring count with\\nactive RSS contexts\\\") proves that allowing indirection table to contain\\nchannels with out of bounds IDs may lead to crashes. Currently the\\nmax channel check in the core gets skipped if driver can\u0027t fetch\\nthe indirection table or when we can\u0027t allocate memory.\\n\\nBoth of those conditions should be extremely rare but if they do\\nhappen we should try to be safe and fail the channel change.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.10\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"4.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:53:28.772Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46834\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:53:28.772Z\", \"dateReserved\": \"2024-09-11T15:12:18.287Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-27T12:39:31.110Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.