CVE-2024-50094: sfc: Don't invoke xdp_do_flush() from netpoll.
In the Linux kernel, the following vulnerability has been resolved:
sfc: Don't invoke xdpdoflush() from netpoll.
Yury reported a crash in the sfc driver originated from netpollsendudp(). The netconsole sends a message and then netpoll invokes the driver's NAPI function with a budget of zero. It is dedicated to allow driver to free TX resources, that it may have used while sending the packet.
In the netpoll case the driver invokes xdpdoflush() unconditionally, leading to crash because bpfnetcontext was never assigned.
Invoke xdpdoflush() only if budget is not zero.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Configuration
Update the kernel/netpoll behavior so that xdp_do_flush() is invoked only if budget != 0; this prevents the sfc crash caused by bpf_net_context never being assigned when netpoll invokes the driver with a budget of zero.
Linux kernel (netpoll / sfc driver) xdp_do_flush() invocation condition = Only invoke xdp_do_flush() when budget is not zero (i.e., do not invoke when NAPI budget is 0).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50094?
CVE-2024-50094 has been classified as a moderate severity vulnerability affecting the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2024-50094?
CVE-2024-50094 affects Linux kernel versions between 6.11 and 6.11.4, as well as the 6.12-rc1 and 6.12-rc2 release candidates.
How do I fix CVE-2024-50094?
To resolve CVE-2024-50094, upgrade to a patched version of the Linux kernel that eliminates the vulnerability.
What causes the crash in CVE-2024-50094?
CVE-2024-50094 is caused by a crash in the sfc driver triggered by invoking xdp_do_flush() from netpoll.
Can CVE-2024-50094 be exploited remotely?
CVE-2024-50094 does not involve remote exploitation but can lead to local denial of service through system crashes.