{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-57843", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-01-11T12:32:49.621Z", "datePublished": "2025-01-11T14:30:57.255Z", "dateUpdated": "2026-08-05T11:46:39.052Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:39.052Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix overflow inside virtnet_rq_alloc\n\nWhen the frag just got a page, then may lead to regression on VM.\nSpecially if the sysctl net.core.high_order_alloc_disable value is 1,\nthen the frag always get a page when do refill.\n\nWhich could see reliable crashes or scp failure (scp a file 100M in size\nto VM).\n\nThe issue is that the virtnet_rq_dma takes up 16 bytes at the beginning\nof a new frag. When the frag size is larger than PAGE_SIZE,\neverything is fine. However, if the frag is only one page and the\ntotal size of the buffer and virtnet_rq_dma is larger than one page, an\noverflow may occur.\n\nThe commit f9dac92ba908 (\"virtio_ring: enable premapped mode whatever\nuse_dma_api\") introduced this problem. And we reverted some commits to\nfix this in last linux version. Now we try to enable it and fix this\nbug directly.\n\nHere, when the frag size is not enough, we reduce the buffer len to fix\nthis problem." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The overflow is driven entirely by the virtio-net RX refill path: a remote peer sending sustained large/GRO-coalesced traffic saturates `mrg_avg_pkt_len`, making `get_mergeable_buf_len()` return exactly PAGE_SIZE and turning every fresh single-page refill into a 16-byte out-of-bounds DMA. No local access to the guest is needed — packets merely have to reach the guest's NIC, even if later dropped by the firewall.\nAC:L - Once the target is in a vulnerable configuration (XDP attached, `net.core.high_order_alloc_disable=1`, 64K-page kernel, or ordinary order-3 allocation failure under memory pressure the attacker's own traffic helps induce), the overflow is deterministic and repeats on every fresh page — the commit describes it as \"reliable crashes\", with no race window or unknown memory layout to win.\nPR:N - The attacker only needs to send network traffic to the guest; the RX refill and EWMA update happen in the driver before any socket, authentication, or firewall decision. No credentials or local account are required.\nUI:N - The condition is created by the packet stream itself as the driver refills the receive queue; no administrator or user action is needed beyond the interface being up.\nS:U - The out-of-bounds DMA write and the over-long skb frag corrupt/expose memory belonging to the same guest kernel that owns the driver; no VM, IOMMU, or sandbox boundary is crossed by the vulnerability itself.\nC:H - The published buffer extends past the order-0 page, so the skb frag covers 16 bytes of an unrelated adjacent page that are copied into the delivered packet and can leak kernel heap contents to userspace or back onto the network, and the accompanying heap corruption can be leveraged for further disclosure.\nI:H - The device is handed an sg entry 16 bytes longer than the DMA mapping, so attacker-supplied packet bytes are written past the page boundary into an adjacent buddy page (or past a swiotlb slot) — a page-granular out-of-bounds write primitive with controlled data, usable against neighbouring slab objects or page tables.\nA:H - The fix commit states the bug produces \"reliable crashes or scp failure\" on affected VMs, and the corruption of adjacent kernel memory (or IOMMU fault storms) readily panics the guest." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/virtio_net.c" ], "versions": [ { "version": "295525e29a5b5694a6e96864f0c1365f79639863", "lessThan": "a8f7d6963768b114ec9644ff0148dde4c104e84b", "status": "affected", "versionType": "git" }, { "version": "295525e29a5b5694a6e96864f0c1365f79639863", "lessThan": "67a11de8965c2ab19e215fb6651d44847e068614", "status": "affected", "versionType": "git" }, { "version": "295525e29a5b5694a6e96864f0c1365f79639863", "lessThan": "6aacd1484468361d1d04badfe75f264fa5314864", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/virtio_net.c" ], "versions": [ { "version": "6.6", "status": "affected" }, { "version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.66", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.5", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.66" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/a8f7d6963768b114ec9644ff0148dde4c104e84b" }, { "url": "https://git.kernel.org/stable/c/67a11de8965c2ab19e215fb6651d44847e068614" }, { "url": "https://git.kernel.org/stable/c/6aacd1484468361d1d04badfe75f264fa5314864" } ], "title": "virtio-net: fix overflow inside virtnet_rq_alloc", "x_generator": { "engine": "bippy-1.2.0" } } } }