{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-57801", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-01-15T13:08:59.741Z", "datePublished": "2025-01-15T13:10:24.619Z", "dateUpdated": "2026-08-05T11:46:35.806Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:35.806Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Skip restore TC rules for vport rep without loaded flag\n\nDuring driver unload, unregister_netdev is called after unloading\nvport rep. So, the mlx5e_rep_priv is already freed while trying to get\nrpriv->netdev, or walk rpriv->tc_ht, which results in use-after-free.\nSo add the checking to make sure access the data of vport rep which is\nstill loaded." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is only reachable through local device configuration — XFRM/netlink IPsec offload state and policy deletion, SR-IOV/SF vport reconfiguration, or devlink/driver unload. No remote peer input reaches `mlx5_esw_ipsec_restore_dest_uplink()`.\nAC:L - This is not a race: `rep->rep_data[REP_ETH].priv` is left permanently dangling after any vport rep unload, and the attacker independently controls when the last eswitch IPsec TX rule is removed to trigger the walk. Freshly freed kmalloc memory retains a non-NULL `rpriv->netdev`, so the old guard reliably fails to catch the freed object, and both required kconfigs are default-y.\nPR:L - Triggering requires network-device administration (CAP_NET_ADMIN for XFRM offload state/policy and SR-IOV/SF vport changes) rather than real root, and consistent with kernel.org CNA scoring of comparable mlx5 eswitch/flow-steering UAFs this is treated as a low-privileged local capability.\nUI:N - The vport rep unload and the subsequent IPsec TX flow-table refcount drop are both performed by the attacker; no action by any other user or victim is needed.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The freed `mlx5e_rep_priv` is read back (`rpriv->netdev`, `rpriv->tc_ht`, `tc_ht.tbl`) and the walk then dereferences reclaimed-slab contents as `mlx5e_tc_flow` objects, so a heap-spray of the freed object yields an attacker-directed kernel read primitive.\nI:H - `rhashtable_walk_enter()` writes into the freed object (spinlock acquire) and performs `list_add()` through a `tbl` pointer read out of freed memory, giving a write through an attacker-influenceable pointer; the walk additionally programs hardware flow-rule destinations from bogus flow structures.\nA:H - Even without exploitation, walking a freed rhashtable dereferences garbage bucket-table pointers and causes an immediate kernel oops/panic, and the dangling rep pointer makes the crash reproducible on demand." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c", "drivers/net/ethernet/mellanox/mlx5/core/eswitch.h", "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c" ], "versions": [ { "version": "d1569537a837d66620aa7ffc2bddf918e902f227", "lessThan": "3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0", "status": "affected", "versionType": "git" }, { "version": "d1569537a837d66620aa7ffc2bddf918e902f227", "lessThan": "47c78d3fc26e38ab805613a0f592dc8a820c7c64", "status": "affected", "versionType": "git" }, { "version": "d1569537a837d66620aa7ffc2bddf918e902f227", "lessThan": "5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c", "drivers/net/ethernet/mellanox/mlx5/core/eswitch.h", "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c" ], "versions": [ { "version": "6.6", "status": "affected" }, { "version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.70", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.9", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.70" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0" }, { "url": "https://git.kernel.org/stable/c/47c78d3fc26e38ab805613a0f592dc8a820c7c64" }, { "url": "https://git.kernel.org/stable/c/5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be" } ], "title": "net/mlx5e: Skip restore TC rules for vport rep without loaded flag", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-57801", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-02-11T15:41:06.687224Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T15:45:20.073Z" } } ] } }