Junglewise Threat Intelligence

CVE-2024-50001: Linux Kernel mlx5 incorrect DMA unmapping in WQE transmit

CVE-2024-50001 · Severity: medium · CVSS 5.5 · Published 2024-10-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Mellanox network driver can cause system instability or network hardware failure under heavy memory pressure. When the system runs low on memory, the driver may incorrectly release active memory mappings used by the network card, leading the hardware to enter an error state. This can result in a denial of service where network connectivity is lost until the system or hardware is reset.

Technical details

A vulnerability in the `net/mlx5` driver's multi-packet Work Queue Element (WQE) transmit path arises from improper handling of DMA mapping failures. When `mlx5e_sq_xmit_mpwqe` fails to obtain a DMA mapping (typically due to IOMMU page table allocation failure under memory pressure), the code jumps to an error label that erroneously calls `mlx5e_dma_unmap_wqe_err`. This function removes an entry from the Send Queue's (SQ) FIFO list of active mappings. Because the current mapping attempt already failed, this action unmaps a different, unrelated active DMA mapping. If the PCI function subsequently attempts to use that IOVA, the IOMMU detects an unauthorized access, potentially placing the PCI function into an error state (observed on s390 architectures). The fix involves removing the erroneous unmap call from the error path.

Affected products

  • Linux Linux Kernel 5.10 to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.55, 6.7 to 6.10.14, 6.11 to 6.11.3

Timeline

  • 2024-10-21: advisory: CVE-2024-50001 published
  • 2024-09-25: patched: Initial fix committed to mainline kernel

References

Related threats