CVE-2024-57801 (GCVE-0-2024-57801)
Vulnerability from cvelistv5
Published
2025-01-15 13:10
Modified
2026-08-05 11:46
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Skip restore TC rules for vport rep without loaded flag During driver unload, unregister_netdev is called after unloading vport rep. So, the mlx5e_rep_priv is already freed while trying to get rpriv->netdev, or walk rpriv->tc_ht, which results in use-after-free. So add the checking to make sure access the data of vport rep which is still loaded.
References
Impacted products
Vendor Product Version
Linux Linux Version: d1569537a837d66620aa7ffc2bddf918e902f227
Version: d1569537a837d66620aa7ffc2bddf918e902f227
Version: d1569537a837d66620aa7ffc2bddf918e902f227
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-57801",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T15:41:06.687224Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T15:45:20.073Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c",
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch.h",
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0",
              "status": "affected",
              "version": "d1569537a837d66620aa7ffc2bddf918e902f227",
              "versionType": "git"
            },
            {
              "lessThan": "47c78d3fc26e38ab805613a0f592dc8a820c7c64",
              "status": "affected",
              "version": "d1569537a837d66620aa7ffc2bddf918e902f227",
              "versionType": "git"
            },
            {
              "lessThan": "5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be",
              "status": "affected",
              "version": "d1569537a837d66620aa7ffc2bddf918e902f227",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c",
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch.h",
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.9",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Skip restore TC rules for vport rep without loaded flag\n\nDuring driver unload, unregister_netdev is called after unloading\nvport rep. So, the mlx5e_rep_priv is already freed while trying to get\nrpriv-\u003enetdev, or walk rpriv-\u003etc_ht, which results in use-after-free.\nSo add the checking to make sure access the data of vport rep which is\nstill loaded."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is only reachable through local device configuration \u2014 XFRM/netlink IPsec offload state and policy deletion, SR-IOV/SF vport reconfiguration, or devlink/driver unload. No remote peer input reaches `mlx5_esw_ipsec_restore_dest_uplink()`.\nAC:L - This is not a race: `rep-\u003erep_data[REP_ETH].priv` is left permanently dangling after any vport rep unload, and the attacker independently controls when the last eswitch IPsec TX rule is removed to trigger the walk. Freshly freed kmalloc memory retains a non-NULL `rpriv-\u003enetdev`, so the old guard reliably fails to catch the freed object, and both required kconfigs are default-y.\nPR:L - Triggering requires network-device administration (CAP_NET_ADMIN for XFRM offload state/policy and SR-IOV/SF vport changes) rather than real root, and consistent with kernel.org CNA scoring of comparable mlx5 eswitch/flow-steering UAFs this is treated as a low-privileged local capability.\nUI:N - The vport rep unload and the subsequent IPsec TX flow-table refcount drop are both performed by the attacker; no action by any other user or victim is needed.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The freed `mlx5e_rep_priv` is read back (`rpriv-\u003enetdev`, `rpriv-\u003etc_ht`, `tc_ht.tbl`) and the walk then dereferences reclaimed-slab contents as `mlx5e_tc_flow` objects, so a heap-spray of the freed object yields an attacker-directed kernel read primitive.\nI:H - `rhashtable_walk_enter()` writes into the freed object (spinlock acquire) and performs `list_add()` through a `tbl` pointer read out of freed memory, giving a write through an attacker-influenceable pointer; the walk additionally programs hardware flow-rule destinations from bogus flow structures.\nA:H - Even without exploitation, walking a freed rhashtable dereferences garbage bucket-table pointers and causes an immediate kernel oops/panic, and the dangling rep pointer makes the crash reproducible on demand."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:35.806Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/47c78d3fc26e38ab805613a0f592dc8a820c7c64"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be"
        }
      ],
      "title": "net/mlx5e: Skip restore TC rules for vport rep without loaded flag",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57801",
    "datePublished": "2025-01-15T13:10:24.619Z",
    "dateReserved": "2025-01-15T13:08:59.741Z",
    "dateUpdated": "2026-08-05T11:46:35.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-57801\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-11T15:41:06.687224Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-11T15:41:08.156Z\"}}], \"cna\": {\"title\": \"net/mlx5e: Skip restore TC rules for vport rep without loaded flag\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is only reachable through local device configuration \\u2014 XFRM/netlink IPsec offload state and policy deletion, SR-IOV/SF vport reconfiguration, or devlink/driver unload. No remote peer input reaches `mlx5_esw_ipsec_restore_dest_uplink()`.\\nAC:L - This is not a race: `rep-\u003erep_data[REP_ETH].priv` is left permanently dangling after any vport rep unload, and the attacker independently controls when the last eswitch IPsec TX rule is removed to trigger the walk. Freshly freed kmalloc memory retains a non-NULL `rpriv-\u003enetdev`, so the old guard reliably fails to catch the freed object, and both required kconfigs are default-y.\\nPR:L - Triggering requires network-device administration (CAP_NET_ADMIN for XFRM offload state/policy and SR-IOV/SF vport changes) rather than real root, and consistent with kernel.org CNA scoring of comparable mlx5 eswitch/flow-steering UAFs this is treated as a low-privileged local capability.\\nUI:N - The vport rep unload and the subsequent IPsec TX flow-table refcount drop are both performed by the attacker; no action by any other user or victim is needed.\\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\\nC:H - The freed `mlx5e_rep_priv` is read back (`rpriv-\u003enetdev`, `rpriv-\u003etc_ht`, `tc_ht.tbl`) and the walk then dereferences reclaimed-slab contents as `mlx5e_tc_flow` objects, so a heap-spray of the freed object yields an attacker-directed kernel read primitive.\\nI:H - `rhashtable_walk_enter()` writes into the freed object (spinlock acquire) and performs `list_add()` through a `tbl` pointer read out of freed memory, giving a write through an attacker-influenceable pointer; the walk additionally programs hardware flow-rule destinations from bogus flow structures.\\nA:H - Even without exploitation, walking a freed rhashtable dereferences garbage bucket-table pointers and causes an immediate kernel oops/panic, and the dangling rep pointer makes the crash reproducible on demand.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d1569537a837d66620aa7ffc2bddf918e902f227\", \"lessThan\": \"3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d1569537a837d66620aa7ffc2bddf918e902f227\", \"lessThan\": \"47c78d3fc26e38ab805613a0f592dc8a820c7c64\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d1569537a837d66620aa7ffc2bddf918e902f227\", \"lessThan\": \"5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c\", \"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h\", \"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.70\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c\", \"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h\", \"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0\"}, {\"url\": \"https://git.kernel.org/stable/c/47c78d3fc26e38ab805613a0f592dc8a820c7c64\"}, {\"url\": \"https://git.kernel.org/stable/c/5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: Skip restore TC rules for vport rep without loaded flag\\n\\nDuring driver unload, unregister_netdev is called after unloading\\nvport rep. So, the mlx5e_rep_priv is already freed while trying to get\\nrpriv-\u003enetdev, or walk rpriv-\u003etc_ht, which results in use-after-free.\\nSo add the checking to make sure access the data of vport rep which is\\nstill loaded.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.70\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.9\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:46:35.806Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-57801\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:46:35.806Z\", \"dateReserved\": \"2025-01-15T13:08:59.741Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-15T13:10:24.619Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.