Junglewise Threat Intelligence

CVE-2024-35958: Linux Kernel ENA driver incorrect descriptor freeing in TX queues

CVE-2024-35958 · Severity: medium · CVSS 5.5 · Published 2024-05-20

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Elastic Network Adapter (ENA) driver can cause system crashes during network interface resets. This component is commonly used in cloud environments to manage high-speed network traffic. An exploit could lead to a denial-of-service condition, impacting the availability of affected servers and the services running on them.

Technical details

A flaw exists in the 'ena_free_tx_bufs' function within the Amazon ENA (Elastic Network Adapter) driver. The function incorrectly assumes all transmit (TX) queues contain standard socket buffers (skb) and attempts to free them using 'napi_consume_skb()'. However, ENA also utilizes XDP-specific queues (XDP_REDIRECT or XDP_TX) which require 'xdp_return_frame()'. When a Virtual Function (VF) reset occurs, this mismatch in memory management leads to incorrect descriptor freeing and subsequent kernel crashes. The vulnerability is reachable locally and can be mitigated by applying the provided kernel patches which introduce a check for XDP-specific rings before freeing descriptors.

Affected products

  • Linux Linux Kernel 5.6 to 5.10.216, 5.11 to 5.15.156, 5.16 to 6.1.87, 6.2 to 6.6.28, 6.7 to 6.8.7, 6.9-rc1 to 6.9-rc3

Timeline

  • 2024-05-20: disclosed
  • 2024-04-17: patched: Initial patch commit in stable tree

References

Related threats