CVE-2024-35901: net: mana: Fix Rx DMA datasize and skb_over_panic
In the Linux kernel, the following vulnerability has been resolved:
net: mana: Fix Rx DMA datasize and skboverpanic
managetrxbufcfg() aligns the RX buffer's DMA datasize to be multiple of 64. So a packet slightly bigger than mtu+14, say 1536, can be received and cause skboverpanic.
Sample dmesg: [ 5325.237162] skbuff: skboverpanic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev:<NULL> [ 5325.243689] ------------[ cut here ]------------ [ 5325.245748] kernel BUG at net/core/skbuff.c:192! [ 5325.247838] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 5325.258374] RIP: 0010:skbpanic+0x4f/0x60 [ 5325.302941] Call Trace: [ 5325.304389] <IRQ> [ 5325.315794] ? skbpanic+0x4f/0x60 [ 5325.317457] ? asmexcinvalidop+0x1f/0x30 [ 5325.319490] ? skbpanic+0x4f/0x60 [ 5325.321161] skbput+0x4e/0x50 [ 5325.322670] manapoll+0x6fa/0xb50 [mana] [ 5325.324578] napipoll+0x33/0x1e0 [ 5325.326328] netrxaction+0x12e/0x280
As discussed internally, this alignment is not necessary. To fix this bug, remove it from the code. So oversized packets will be marked as CQERXTRUNCATED by NIC, and dropped.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Remove
Remove
Linux kernel net: manafrom your environment.Remove the DMA datasize alignment logic in mana_get_rxbuf_cfg() (it aligns the RX buffer's DMA datasize to be a multiple of 64) as part of fixing the mana Rx DMA datasize and skb_over_panic issue.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35901?
CVE-2024-35901 has a medium severity rating due to potential denial of service risks.
How do I fix CVE-2024-35901?
To fix CVE-2024-35901, upgrade to the patched versions of the Linux kernel: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What systems are affected by CVE-2024-35901?
CVE-2024-35901 affects specific versions of the Linux kernel used in Debian.
What type of vulnerability is CVE-2024-35901?
CVE-2024-35901 is a buffer overflow vulnerability related to DMA buffer handling in the Linux kernel.
Can CVE-2024-35901 lead to system crashes?
Yes, CVE-2024-35901 can lead to system crashes due to skb_over_panic caused by oversized packets.