CVE-2024-57843 (GCVE-0-2024-57843)
Vulnerability from cvelistv5
Published
2025-01-11 14:30
Modified
2026-08-05 11:46
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix overflow inside virtnet_rq_alloc When the frag just got a page, then may lead to regression on VM. Specially if the sysctl net.core.high_order_alloc_disable value is 1, then the frag always get a page when do refill. Which could see reliable crashes or scp failure (scp a file 100M in size to VM). The issue is that the virtnet_rq_dma takes up 16 bytes at the beginning of a new frag. When the frag size is larger than PAGE_SIZE, everything is fine. However, if the frag is only one page and the total size of the buffer and virtnet_rq_dma is larger than one page, an overflow may occur. The commit f9dac92ba908 ("virtio_ring: enable premapped mode whatever use_dma_api") introduced this problem. And we reverted some commits to fix this in last linux version. Now we try to enable it and fix this bug directly. Here, when the frag size is not enough, we reduce the buffer len to fix this problem.
References
Impacted products
Vendor Product Version
Linux Linux Version: 295525e29a5b5694a6e96864f0c1365f79639863
Version: 295525e29a5b5694a6e96864f0c1365f79639863
Version: 295525e29a5b5694a6e96864f0c1365f79639863
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a8f7d6963768b114ec9644ff0148dde4c104e84b",
              "status": "affected",
              "version": "295525e29a5b5694a6e96864f0c1365f79639863",
              "versionType": "git"
            },
            {
              "lessThan": "67a11de8965c2ab19e215fb6651d44847e068614",
              "status": "affected",
              "version": "295525e29a5b5694a6e96864f0c1365f79639863",
              "versionType": "git"
            },
            {
              "lessThan": "6aacd1484468361d1d04badfe75f264fa5314864",
              "status": "affected",
              "version": "295525e29a5b5694a6e96864f0c1365f79639863",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix overflow inside virtnet_rq_alloc\n\nWhen the frag just got a page, then may lead to regression on VM.\nSpecially if the sysctl net.core.high_order_alloc_disable value is 1,\nthen the frag always get a page when do refill.\n\nWhich could see reliable crashes or scp failure (scp a file 100M in size\nto VM).\n\nThe issue is that the virtnet_rq_dma takes up 16 bytes at the beginning\nof a new frag. When the frag size is larger than PAGE_SIZE,\neverything is fine. However, if the frag is only one page and the\ntotal size of the buffer and virtnet_rq_dma is larger than one page, an\noverflow may occur.\n\nThe commit f9dac92ba908 (\"virtio_ring: enable premapped mode whatever\nuse_dma_api\") introduced this problem. And we reverted some commits to\nfix this in last linux version. Now we try to enable it and fix this\nbug directly.\n\nHere, when the frag size is not enough, we reduce the buffer len to fix\nthis problem."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The overflow is driven entirely by the virtio-net RX refill path: a remote peer sending sustained large/GRO-coalesced traffic saturates `mrg_avg_pkt_len`, making `get_mergeable_buf_len()` return exactly PAGE_SIZE and turning every fresh single-page refill into a 16-byte out-of-bounds DMA. No local access to the guest is needed \u2014 packets merely have to reach the guest\u0027s NIC, even if later dropped by the firewall.\nAC:L - Once the target is in a vulnerable configuration (XDP attached, `net.core.high_order_alloc_disable=1`, 64K-page kernel, or ordinary order-3 allocation failure under memory pressure the attacker\u0027s own traffic helps induce), the overflow is deterministic and repeats on every fresh page \u2014 the commit describes it as \"reliable crashes\", with no race window or unknown memory layout to win.\nPR:N - The attacker only needs to send network traffic to the guest; the RX refill and EWMA update happen in the driver before any socket, authentication, or firewall decision. No credentials or local account are required.\nUI:N - The condition is created by the packet stream itself as the driver refills the receive queue; no administrator or user action is needed beyond the interface being up.\nS:U - The out-of-bounds DMA write and the over-long skb frag corrupt/expose memory belonging to the same guest kernel that owns the driver; no VM, IOMMU, or sandbox boundary is crossed by the vulnerability itself.\nC:H - The published buffer extends past the order-0 page, so the skb frag covers 16 bytes of an unrelated adjacent page that are copied into the delivered packet and can leak kernel heap contents to userspace or back onto the network, and the accompanying heap corruption can be leveraged for further disclosure.\nI:H - The device is handed an sg entry 16 bytes longer than the DMA mapping, so attacker-supplied packet bytes are written past the page boundary into an adjacent buddy page (or past a swiotlb slot) \u2014 a page-granular out-of-bounds write primitive with controlled data, usable against neighbouring slab objects or page tables.\nA:H - The fix commit states the bug produces \"reliable crashes or scp failure\" on affected VMs, and the corruption of adjacent kernel memory (or IOMMU fault storms) readily panics the guest."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:39.052Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a8f7d6963768b114ec9644ff0148dde4c104e84b"
        },
        {
          "url": "https://git.kernel.org/stable/c/67a11de8965c2ab19e215fb6651d44847e068614"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aacd1484468361d1d04badfe75f264fa5314864"
        }
      ],
      "title": "virtio-net: fix overflow inside virtnet_rq_alloc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57843",
    "datePublished": "2025-01-11T14:30:57.255Z",
    "dateReserved": "2025-01-11T12:32:49.621Z",
    "dateUpdated": "2026-08-05T11:46:39.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.