Riskcovery

CVE-2024-36281

net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules

State
Published
Severity
Not scored
Published
Jun 21, 2024
Updated
May 23, 2026
Reserved
Jun 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules

rx_create no longer allocates a modify_hdr instance that needs to be cleaned up. The mlx5_modify_header_dealloc call will lead to a NULL pointer dereference. A leak in the rules also previously occurred since there are now two rules populated related to status.

BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 109907067 P4D 109907067 PUD 116890067 PMD 0 Oops: 0000 [#1] SMP CPU: 1 PID: 484 Comm: ip Not tainted 6.9.0-rc2-rrameshbabu+ #254 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Arch Linux 1.16.3-1-1 04/01/2014 RIP: 0010:mlx5_modify_header_dealloc+0xd/0x70 <snip> Call Trace: <TASK> ? show_regs+0x60/0x70 ? __die+0x24/0x70 ? page_fault_oops+0x15f/0x430 ? free_to_partial_list.constprop.0+0x79/0x150 ? do_user_addr_fault+0x2c9/0x5c0 ? exc_page_fault+0x63/0x110 ? asm_exc_page_fault+0x27/0x30 ? mlx5_modify_header_dealloc+0xd/0x70 rx_create+0x374/0x590 rx_add_rule+0x3ad/0x500 ? rx_add_rule+0x3ad/0x500 ? mlx5_cmd_exec+0x2c/0x40 ? mlx5_create_ipsec_obj+0xd6/0x200 mlx5e_accel_ipsec_fs_add_rule+0x31/0xf0 mlx5e_xfrm_add_state+0x426/0xc00 <snip>

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 20af7afcd8b85a4cb413072d631bf9a6469eee3a to before b0a15cde37a8388e57573686f650a17208ae1212Affected
  • 94af50c0a9bb961fe93cf0fdd14eb0883da86721 to before cc9ac559f2e21894c21ac5b0c85fb24a5cab266cAffected
  • 94af50c0a9bb961fe93cf0fdd14eb0883da86721 to before 16d66a4fa81da07bc4ed19f4e53b87263c2f8d38Affected
  • 6.6.8 to before 6.6.33Affected
LinuxLinux
  • 6.7Affected
  • before 6.7Not affected
  • 6.6.33 through 6.6.*Not affected
  • 6.9.4 through 6.9.*Not affected
  • 6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.