{ "dataType": "CVE_RECORD", "cveMetadata": { "cveId": "CVE-2024-27030", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.211Z", "datePublished": "2024-05-01T12:53:25.954Z", "dateUpdated": "2026-08-05T11:29:07.771Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:07.771Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Use separate handlers for interrupts\n\nFor PF to AF interrupt vector and VF to AF vector same\ninterrupt handler is registered which is causing race condition.\nWhen two interrupts are raised to two CPUs at same time\nthen two cores serve same event corrupting the data." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is an MSI-X interrupt handler in the OcteonTX2 RVU admin-function driver, reached by writing the mailbox doorbell from a local PF/VF function (ethtool/netdev operations, or a VFIO-assigned VF), not by processing any remote network data. No packet-processing path leads here, so exploitation requires local access to the host or to a passed-through VF.\nAC:L - The attacker drives both sides of the race himself — one thread spamming PF→AF mailbox messages (e.g. unprivileged `ethtool -a`, which issues `cgx_cfg_pause_frm`) while another spams the VF→AF doorbell on a separate MSI-X vector affined to a different CPU. No condition outside the attacker's control is required, and the race can be retried indefinitely at high rate.\nPR:L - Generating AF mailbox traffic needs only an ordinary local account — several octeontx2 ethtool GET operations (`get_pauseparam`, `get_fecparam`) send mailbox messages with no capability check — or possession of an SR-IOV VF exposed to a container/guest, which can write the mailbox trigger register directly. No root or CAP_NET_ADMIN in the initial namespace is required.\nUI:N - The attacker triggers both interrupt vectors entirely on his own by issuing ethtool/netdev requests and mailbox doorbell writes. No administrator or victim action is needed at any point.\nS:U - The corrupted mailbox bookkeeping and the resulting out-of-bounds accesses are all inside the host kernel, the same security authority as the vulnerable RVU AF driver. No hypervisor, IOMMU, or sandbox boundary is crossed by the corruption itself.\nC:H - When the concurrently-bumped `num_msgs` extends the loop in `__rvu_mbox_handler()` past the valid message list, `msg` is taken from unvalidated memory and `offset` is advanced by an unchecked 16-bit `next_msgoff`, producing out-of-bounds reads outside the 64 KB `ioremap_wc()` mailbox window whose contents are then acted on and echoed back in mailbox responses — an unbounded kernel read primitive.\nI:H - The same overrun performs an unconditional write (`msg->pcifunc &= ...; msg->pcifunc |= ...`) at the attacker-influenced out-of-bounds offset before any signature validation, and the duplicate work-queue dispatch re-executes already-completed AF resource commands such as LF free/detach against released state, corrupting the admin function's resource tables.\nA:H - Duplicate processing of resource-teardown mailbox messages and out-of-range accesses to the ioremapped mailbox region readily oops the kernel, while the mutually-cleared interrupt bits drop mailbox events and wedge the AF↔PF/VF control plane, taking down all NIX/NPA networking on the SoC." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/marvell/octeontx2/af/rvu.c" ], "versions": [ { "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2", "status": "affected", "versionType": "git" }, { "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "766c2627acb2d9d1722cce2e24837044d52d888a", "status": "affected", "versionType": "git" }, { "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "772f18ded0e240cc1fa2b7020cc640e3e5c32b70", "status": "affected", "versionType": "git" }, { "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44", "status": "affected", "versionType": "git" }, { "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "dc29dd00705a62c77de75b6d752259b869aac49d", "status": "affected", "versionType": "git" }, { "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "ad6759e233db6fcc131055f8e23b4eafbe81053c", "status": "affected", "versionType": "git" }, { "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701", "status": "affected", "versionType": "git" }, { "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "50e60de381c342008c0956fd762e1c26408f372c", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/marvell/octeontx2/af/rvu.c" ], "versions": [ { "version": "4.20", "status": "affected" }, { "version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.273", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.214", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.153", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.83", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.23", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.11", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.2", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.4.273" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.214" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.153" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.23" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.7.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.8.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2" }, { "url": "https://git.kernel.org/stable/c/766c2627acb2d9d1722cce2e24837044d52d888a" }, { "url": "https://git.kernel.org/stable/c/772f18ded0e240cc1fa2b7020cc640e3e5c32b70" }, { "url": "https://git.kernel.org/stable/c/29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44" }, { "url": "https://git.kernel.org/stable/c/dc29dd00705a62c77de75b6d752259b869aac49d" }, { "url": "https://git.kernel.org/stable/c/ad6759e233db6fcc131055f8e23b4eafbe81053c" }, { "url": "https://git.kernel.org/stable/c/4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701" }, { "url": "https://git.kernel.org/stable/c/50e60de381c342008c0956fd762e1c26408f372c" } ], "title": "octeontx2-af: Use separate handlers for interrupts", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.937Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/766c2627acb2d9d1722cce2e24837044d52d888a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/772f18ded0e240cc1fa2b7020cc640e3e5c32b70", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/dc29dd00705a62c77de75b6d752259b869aac49d", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ad6759e233db6fcc131055f8e23b4eafbe81053c", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/50e60de381c342008c0956fd762e1c26408f372c", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-27030", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:44:21.007612Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:33.167Z" } } ] }, "dataVersion": "5.2" }