CVE-2024-40990: RDMA/mlx5: Add check for srq max_sge attribute
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Add check for srq maxsge attribute
maxsge attribute is passed by the user, and is inserted and used unchecked, so verify that the value doesn't exceed maximum allowed value before using it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40990?
CVE-2024-40990 has not been assigned a specific CVSS score yet, but it represents a potential risk due to unchecked user input in the Linux kernel.
How do I fix CVE-2024-40990?
To mitigate CVE-2024-40990, upgrade to the recommended patched versions of the Linux kernel that include the fix for this vulnerability.
Which Linux kernel versions are affected by CVE-2024-40990?
CVE-2024-40990 affects specific versions of the Linux kernel prior to the patches, including versions 5.10.x, 6.1.x, and 6.12.x.
What is the impact of CVE-2024-40990?
The impact of CVE-2024-40990 lies in the potential for denial of service or exploitation due to the improper handling of the max_sge attribute.
Is CVE-2024-40990 a local or remote vulnerability?
CVE-2024-40990 is considered a local vulnerability since it requires user-level access to exploit the unchecked attribute in the kernel.