CVE-2024-53088: i40e: fix race condition by adding filter's intermediate sync state
i40e: fix race condition by adding filter's intermediate sync state
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.173.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.64.2-1 - Upgrade
Upgrade
Linux kernel i40e driverto a version that resolves this vulnerability.Patch i40e: fix race condition by adding filter's intermediate sync state - Configuration
Implement/ensure the i40e intermediate sync state "I40E_FILTER_NEW_SYNC" is used while filters are on a tmp_add_list so they are not deleted directly from the hash list; they must be removed using the full process to avoid use-after-free and leaking.
i40e driver / VF filter handling I40E_FILTER_NEW_SYNC intermediate filter state = Enabled (implement intermediate sync state I40E_FILTER_NEW_SYNC for filters on tmp_add_list) - Compensating control
If you observe dmesg errors like "Error I40E_AQ_RC_ENOSPC adding RX filters on VF XX, please set promiscuous on manually for VF XX", set the VF ("VF XX") to promiscuous mode manually.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53088?
CVE-2024-53088 is classified with a medium severity rating due to a race condition in the i40e driver that can lead to MAC/VLAN filter corruption.
How do I fix CVE-2024-53088?
To fix CVE-2024-53088, users should update the Linux kernel to a patched version that resolves the race condition in the i40e driver.
Which Linux kernel versions are affected by CVE-2024-53088?
CVE-2024-53088 affects Linux kernel versions from 4.10 to 5.15.172, 5.16 to 6.1.117, 6.2 to 6.6.61, 6.7 to 6.11.8, and specific release candidates 6.12-rc1 to 6.12-rc6.
What impact does CVE-2024-53088 have on system security?
The impact of CVE-2024-53088 includes potential information leaks and compromised network integrity due to corrupted MAC/VLAN filters.
Is there a workaround for CVE-2024-53088?
Currently, there is no documented workaround for CVE-2024-53088 other than upgrading to a secure version of the Linux kernel.