CVE-2024-46717: net/mlx5e: SHAMPO, Fix incorrect page release
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: SHAMPO, Fix incorrect page release
Under the following conditions: 1) No skb created yet 2) headersize == 0 (no SHAMPO header) 3) headerindex + 1 % MLX5ESHAMPOWQHEADERPERPAGE == 0 (this is the last page fragment of a SHAMPO header page)
a new skb is formed with a page that is NOT a SHAMPO header page (it is a regular data page). Further down in the same function (mlx5ehandlerxcqempwrqshampo()), a SHAMPO header page from headerindex is released. This is wrong and it leads to SHAMPO header pages being released more than once.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46717?
CVE-2024-46717 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-46717?
To fix CVE-2024-46717, upgrade to the recommended versions: 6.1.123-1, 6.1.119-1, or 6.12.11-1.
What versions of Linux are affected by CVE-2024-46717?
CVE-2024-46717 affects Linux versions up to and including 5.10.226-1.
What should I do if I'm running an affected version of the Linux kernel related to CVE-2024-46717?
If running an affected version, you should apply the available patches and upgrades as soon as possible.
Is CVE-2024-46717 related to specific hardware or devices?
CVE-2024-46717 is particularly relevant to environments using the Mellanox mlx5 drivers.