CVE-2024-36006: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrumacltcam: Fix incorrect list API usage
Both the function that migrates all the chunks within a region and the function that migrates all the entries within a chunk call listfirstentry() on the respective lists without checking that the lists are not empty. This is incorrect usage of the API, which leads to the following warning [1].
Fix by returning if the lists are empty as there is nothing to migrate in this case.
[1] WARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrumacltcam.c:1266 mlxswspacltcamvchunkmigrateall+0x1f1/0> Modules linked in: CPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxswcore mlxswspacltcamvregionrehashwork RIP: 0010:mlxswspacltcamvchunkmigrateall+0x1f1/0x2c0 [...] Call Trace: <TASK> mlxswspacltcamvregionrehashwork+0x6c/0x4a0 processonework+0x151/0x370 workerthread+0x2cb/0x3e0 kthread+0xd0/0x100 retfromfork+0x34/0x50 retfromforkasm+0x1a/0x30 </TASK>
Other sources
In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrumacltcam: Fix incorrect list API usage
The Linux kernel CVE team has assigned CVE-2024-36006 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052025-CVE-2024-36006-c032@gregkh/T
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by an error related to spectrumacltcam. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36006?
The severity of CVE-2024-36006 is classified as medium, reflecting a moderate risk in the Linux kernel.
How do I fix CVE-2024-36006?
To fix CVE-2024-36006, update your Linux kernel to one of the specified remedied versions, such as 5.4.275 or 5.10.216 depending on your distribution.
Which systems are affected by CVE-2024-36006?
CVE-2024-36006 affects Linux kernel versions prior to their respective fixed releases in both Red Hat and Debian distributions.
Does CVE-2024-36006 affect both server and desktop environments?
Yes, CVE-2024-36006 affects both server and desktop environments running vulnerable versions of the Linux kernel.
Are there known exploits for CVE-2024-36006?
As of now, there are no publicly known exploits specifically targeting CVE-2024-36006.