CVE-2024-42142: net/mlx5: E-switch, Create ingress ACL when needed
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: E-switch, Create ingress ACL when needed
Currently, ingress acl is used for three features. It is created only when vport metadata match and prio tag are enabled. But active-backup lag mode also uses it. It is independent of vport metadata match and prio tag. And vport metadata match can be disabled using the following devlink command:
# devlink dev param set pci/0000:08:00.0 name eswportmetadata \ value false cmode runtime
If ingress acl is not created, will hit panic when creating drop rule for active-backup lag mode. If always create it, there will be about 5% performance degradation.
Fix it by creating ingress acl when needed. If eswportmetadata is true, ingress acl exists, then create drop rule using existing ingress acl. If eswportmetadata is false, create ingress acl and then create drop rule.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42142?
CVE-2024-42142 has not been specifically assigned a CVSS score in available data, but vulnerabilities in the Linux kernel typically range widely in severity.
How do I fix CVE-2024-42142?
To fix CVE-2024-42142, update to a patched version of the Linux kernel such as 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, or 6.12.12-1.
What does CVE-2024-42142 affect?
CVE-2024-42142 affects the Linux kernel versions between 5.18 and 6.1.98, 6.2 and 6.6.39, and 6.7 and 6.9.9, as well as specific release candidates.
Is there a workaround for CVE-2024-42142?
There are no specific workarounds mentioned for CVE-2024-42142; applying the patch is the recommended solution.
What features are impacted by CVE-2024-42142?
CVE-2024-42142 impacts the ingress ACL creation which is used in active-backup LAG mode and other features in the networking stack.