CVE-2024-57932 (GCVE-0-2024-57932)
Vulnerability from cvelistv5
Published
2025-01-21 12:01
Modified
2026-08-05 11:46
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: gve: guard XDP xmit NDO on existence of xdp queues In GVE, dedicated XDP queues only exist when an XDP program is installed and the interface is up. As such, the NDO XDP XMIT callback should return early if either of these conditions are false. In the case of no loaded XDP program, priv->num_xdp_queues=0 which can cause a divide-by-zero error, and in the case of interface down, num_xdp_queues remains untouched to persist XDP queue count for the next interface up, but the TX pointer itself would be NULL. The XDP xmit callback also needs to synchronize with a device transitioning from open to close. This synchronization will happen via the GVE_PRIV_FLAGS_NAPI_ENABLED bit along with a synchronize_net() call, which waits for any RCU critical sections at call-time to complete.
References
Impacted products
Vendor Product Version
Linux Linux Version: 39a7f4aa3e4a7947614cf1d5c27abba3300adb1e
Version: 39a7f4aa3e4a7947614cf1d5c27abba3300adb1e
Version: 39a7f4aa3e4a7947614cf1d5c27abba3300adb1e
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/google/gve/gve_main.c",
            "drivers/net/ethernet/google/gve/gve_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cbe9eb2c39d09f3c8574febcfa39d8c09d0c7cb5",
              "status": "affected",
              "version": "39a7f4aa3e4a7947614cf1d5c27abba3300adb1e",
              "versionType": "git"
            },
            {
              "lessThan": "35f44eed5828cf1bc7e760d1993ed8549ba41c7b",
              "status": "affected",
              "version": "39a7f4aa3e4a7947614cf1d5c27abba3300adb1e",
              "versionType": "git"
            },
            {
              "lessThan": "ff7c2dea9dd1a436fc79d6273adffdcc4a7ffea3",
              "status": "affected",
              "version": "39a7f4aa3e4a7947614cf1d5c27abba3300adb1e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/google/gve/gve_main.c",
            "drivers/net/ethernet/google/gve/gve_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: guard XDP xmit NDO on existence of xdp queues\n\nIn GVE, dedicated XDP queues only exist when an XDP program is installed\nand the interface is up. As such, the NDO XDP XMIT callback should\nreturn early if either of these conditions are false.\n\nIn the case of no loaded XDP program, priv-\u003enum_xdp_queues=0 which can\ncause a divide-by-zero error, and in the case of interface down,\nnum_xdp_queues remains untouched to persist XDP queue count for the next\ninterface up, but the TX pointer itself would be NULL.\n\nThe XDP xmit callback also needs to synchronize with a device\ntransitioning from open to close. This synchronization will happen via\nthe GVE_PRIV_FLAGS_NAPI_ENABLED bit along with a synchronize_net() call,\nwhich waits for any RCU critical sections at call-time to complete."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable NDO is reached purely from the receive softirq path \u2014 a remote frame arrives on any NIC, the XDP program calls bpf_redirect_map() to the gve interface, and xdp_do_redirect()/bq_xmit_all() invokes gve_xdp_xmit(); no local access is needed by the attacker, only network traffic sent to the host.\nAC:L - The divide-by-zero variant is fully deterministic and needs no race \u2014 gve advertises NETDEV_XDP_ACT_NDO_XMIT at probe time regardless of whether an XDP program is loaded, so the first redirected packet crashes the host; for the close/unload race the attacker drives one side by saturating the redirect path and can retry indefinitely.\nPR:N - The trigger is an unauthenticated packet on the wire; the attacker needs no account, credentials, or any privilege on the target \u2014 the XDP redirect configuration is a property of the victim host, not something the attacker must possess.\nUI:N - No victim action is required; the crash or use-after-free happens automatically in NAPI context when the redirected frame is processed.\nS:U - The corruption and crash are confined to the host kernel\u0027s own memory and security authority, with no crossing into a hypervisor, IOMMU, or other trust boundary.\nC:H - The unsynchronized close/XDP-unload race (the reason the fix adds synchronize_net()) leaves gve_xdp_xmit writing to and reading from a freed gve_tx_ring, freed tx-\u003edesc/q_resources DMA memory, and a freed queue-page-list FIFO; such a use-after-free on reallocated kernel memory yields a disclosure primitive.\nI:H - The use-after-free window lets attacker-controlled packet bytes be memcpy\u0027d into freed, reallocatable QPL pages (memcpy(tx-\u003etx_fifo.base + iov_offset, data, len)) along with descriptor and doorbell writes into freed DMA-coherent memory \u2014 an attacker-influenced write into arbitrary reused kernel allocations.\nA:H - Both the smp_processor_id() % 0 divide-by-zero and the priv-\u003etx == NULL dereference occur in softirq context, where oops_end() escalates to panic(\"Fatal exception in interrupt\"), producing an immediate whole-system crash that a remote attacker can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:58.733Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cbe9eb2c39d09f3c8574febcfa39d8c09d0c7cb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/35f44eed5828cf1bc7e760d1993ed8549ba41c7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff7c2dea9dd1a436fc79d6273adffdcc4a7ffea3"
        }
      ],
      "title": "gve: guard XDP xmit NDO on existence of xdp queues",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57932",
    "datePublished": "2025-01-21T12:01:29.212Z",
    "dateReserved": "2025-01-19T11:50:08.377Z",
    "dateUpdated": "2026-08-05T11:46:58.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.