{ "dataType": "CVE_RECORD", "cveMetadata": { "cveId": "CVE-2024-35854", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.106Z", "datePublished": "2024-05-17T14:47:30.775Z", "dateUpdated": "2026-08-05T11:30:18.702Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:18.702Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash\n\nThe rehash delayed work migrates filters from one region to another\naccording to the number of available credits.\n\nThe migrated from region is destroyed at the end of the work if the\nnumber of credits is non-negative as the assumption is that this is\nindicative of migration being complete. This assumption is incorrect as\na non-negative number of credits can also be the result of a failed\nmigration.\n\nThe destruction of a region that still has filters referencing it can\nresult in a use-after-free [1].\n\nFix by not destroying the region if migration failed.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\nRead of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858\n\nCPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nCall Trace:\n \n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\n mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70\n mlxsw_sp_acl_atcam_entry_del+0x81/0x210\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n \n\nAllocated by task 174:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc+0x19c/0x360\n mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 7:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xc1/0x290\n mlxsw_sp_acl_tcam_region_destroy+0x272/0x310\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The only path into the vulnerable rehash work is local configuration of hardware-offloaded tc flower filters via rtnetlink (`mlxsw_sp_flower_replace` → `mlxsw_sp_acl_rule_add`), plus the devlink `acl_region_rehash_interval` knob; the multicast-routing ruleset that could be influenced by received traffic explicitly disables rehash, so no received packet reaches this code.\nAC:L - The attacker controls every precondition — the number, priority and mask diversity of offloaded filters, and hence the eRP/TCAM resource exhaustion that makes migration and its rollback fail — while the rehash delayed work re-arms itself automatically every 5 s, so there is no race to win and no state outside the attacker's influence.\nPR:L - Installing offloaded flower filters requires only CAP_NET_ADMIN checked against the owning network namespace's user_ns (`netlink_net_capable(skb, CAP_NET_ADMIN)`), which an unprivileged user holds in their own user namespace once a switch port is delegated to that netns — not real root in the initial namespace.\nUI:N - The attacker performs all steps itself — adding and removing tc flower rules until the device runs out of resources — and the periodic rehash worker then fires on its own with no victim action.\nS:U - The freed object and all subsequent dereferences are kernel heap memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `mlxsw_sp_acl_tcam_region` comes from a sprayable general-purpose kmalloc cache and is later dereferenced as `cregion->region->tcam_region_info` and `cregion->parman`, so reclaiming the slot lets the attacker steer reads to arbitrary kernel addresses; per use-after-free scoring this is High.\nI:H - The same stale allocation is used for an indirect call `cregion->ops->entry_remove(...)` and for `parman_item_remove()`/`rhashtable_remove_fast()`/`list_del()` writes, giving both a control-flow-hijack and a controlled-write primitive; stale `tcam_region_info` is additionally written to the ASIC, corrupting the switch's hardware ACL state.\nA:H - The confirmed KASAN slab-use-after-free in `mlxsw_sp_acl_ctcam_region_entry_remove()` runs from the `mlxsw_core` workqueue and reliably oopses/panics the kernel, and because the work re-arms every 5 s the condition recurs until the switch is unusable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "versions": [ { "version": "c9c9af91f1d9a636aecc55302c792538e549a430", "lessThan": "e118e7ea24d1392878ef85926627c6bc640c4388", "status": "affected", "versionType": "git" }, { "version": "c9c9af91f1d9a636aecc55302c792538e549a430", "lessThan": "a429a912d6c779807f4d72a6cc0a1efaaa3613e1", "status": "affected", "versionType": "git" }, { "version": "c9c9af91f1d9a636aecc55302c792538e549a430", "lessThan": "4c89642ca47fb620914780c7c51d8d1248201121", "status": "affected", "versionType": "git" }, { "version": "c9c9af91f1d9a636aecc55302c792538e549a430", "lessThan": "813e2ab753a8f8c243a39ede20c2e0adc15f3887", "status": "affected", "versionType": "git" }, { "version": "c9c9af91f1d9a636aecc55302c792538e549a430", "lessThan": "311eeaa7b9e26aba5b3d57b09859f07d8e9fc049", "status": "affected", "versionType": "git" }, { "version": "c9c9af91f1d9a636aecc55302c792538e549a430", "lessThan": "a02687044e124f8ccb427cd3632124a4e1a7d7c1", "status": "affected", "versionType": "git" }, { "version": "c9c9af91f1d9a636aecc55302c792538e549a430", "lessThan": "54225988889931467a9b55fdbef534079b665519", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "versions": [ { "version": "5.1", "status": "affected" }, { "version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.275", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.216", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.158", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.90", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.30", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.9", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.4.275" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.10.216" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.15.158" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.1.90" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.6.30" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.8.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e118e7ea24d1392878ef85926627c6bc640c4388" }, { "url": "https://git.kernel.org/stable/c/a429a912d6c779807f4d72a6cc0a1efaaa3613e1" }, { "url": "https://git.kernel.org/stable/c/4c89642ca47fb620914780c7c51d8d1248201121" }, { "url": "https://git.kernel.org/stable/c/813e2ab753a8f8c243a39ede20c2e0adc15f3887" }, { "url": "https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049" }, { "url": "https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1" }, { "url": "https://git.kernel.org/stable/c/54225988889931467a9b55fdbef534079b665519" } ], "title": "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free" } ] } ], "affected": [ { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "c9c9af91f1d9", "status": "affected" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "5.1", "status": "affected" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "0", "status": "unaffected" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "5.4.275", "status": "unaffected" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "5.10.216", "status": "unaffected" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "5.15.158", "status": "unaffected" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "6.1.90", "status": "unaffected" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "6.6.30", "status": "unaffected" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "6.8.9", "status": "unaffected" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "6.9", "status": "unaffected" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2024-05-17T16:58:28.959142Z", "id": "CVE-2024-35854", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T21:17:40.149Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:47.699Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/e118e7ea24d1392878ef85926627c6bc640c4388", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/a429a912d6c779807f4d72a6cc0a1efaaa3613e1", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/4c89642ca47fb620914780c7c51d8d1248201121", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/813e2ab753a8f8c243a39ede20c2e0adc15f3887", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/54225988889931467a9b55fdbef534079b665519", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": [ "x_transferred" ] } ] } ] }, "dataVersion": "5.2" }