CVE-2024-57932: gve: guard XDP xmit NDO on existence of xdp queues
In the Linux kernel, the following vulnerability has been resolved:
gve: guard XDP xmit NDO on existence of xdp queues
In GVE, dedicated XDP queues only exist when an XDP program is installed and the interface is up. As such, the NDO XDP XMIT callback should return early if either of these conditions are false.
In the case of no loaded XDP program, priv->numxdpqueues=0 which can cause a divide-by-zero error, and in the case of interface down, numxdpqueues remains untouched to persist XDP queue count for the next interface up, but the TX pointer itself would be NULL.
The XDP xmit callback also needs to synchronize with a device transitioning from open to close. This synchronization will happen via the GVEPRIVFLAGSNAPIENABLED bit along with a synchronizenet() call, which waits for any RCU critical sections at call-time to complete.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57932?
CVE-2024-57932 has a medium severity rating as it affects the performance of the GVE driver in the Linux kernel.
How do I fix CVE-2024-57932?
To fix CVE-2024-57932, update your Linux kernel to the latest stable version that includes the patch addressing this vulnerability.
What versions of the Linux kernel are affected by CVE-2024-57932?
CVE-2024-57932 affects specific versions of the Linux kernel that include the GVE driver with the vulnerable code.
What are the potential impacts of CVE-2024-57932?
The potential impacts of CVE-2024-57932 may include improper handling of XDP packets and degraded network performance.
Is there a workaround for CVE-2024-57932 until a fix is applied?
Currently, the best approach is to monitor the network interfaces and limit the usage of XDP until a patched kernel is deployed.