First published: Mon Jul 22 2024(Updated: )
A denial-of-service (DoS) attack was found in the mlx5 driver in the Linux kernel. A KVM guest VM using virtio-net can crash the host by sending a short packet (i.e. size < ETH_HLEN). The packet may traverse through vhost-net, macvtap and vlan without any validation/drop. When this packet is presented to mlx5 driver on the host side, the kernel panic happens since mlx5_core assumes the frame size is always >= ETH_HLEN. This vulnerability affects both drivers/net/tun.c and drivers/net/tap.c. <a href="https://access.redhat.com/security/cve/CVE-2024-41091">CVE-2024-41091</a> has been assigned to the TUN side of the issue. Reference: <a href="https://www.openwall.com/lists/oss-security/2024/07/24/4">https://www.openwall.com/lists/oss-security/2024/07/24/4</a>
Affected Software | Affected Version | How to fix |
---|---|---|
Linux kernel | ||
Linux mlx5 driver |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
REDHAT-BUG-2299336 has a high severity due to its potential for causing a denial-of-service (DoS) attack.
To address REDHAT-BUG-2299336, you should apply the latest patches provided by Red Hat for the Linux kernel and mlx5 driver.
REDHAT-BUG-2299336 affects systems running the Linux kernel with the mlx5 driver, particularly those using virtio-net in KVM guest VMs.
REDHAT-BUG-2299336 is identified as a denial-of-service (DoS) vulnerability.
Yes, REDHAT-BUG-2299336 can be exploited remotely through specially crafted short packets sent to the host.