CVE-2024-44970
"Linux NetMLX5e List Corruption Use-After-Free"
Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs with 0 consumed strides for the same WQE even after the WQE is fully consumed and unlinked. This triggers an additional unlink for the same wqe which corrupts the linked list. Fix this scenario by accepting 0 sized consumed strides without unlinking the WQE again.
INFO
Published Date :
Sept. 4, 2024, 7:15 p.m.
Last Modified :
Oct. 3, 2024, 2:22 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-44970.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-44970 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-44970 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Oct. 03, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Changed Reference Type https://git.kernel.org/stable/c/50d8009a0ac02c3311b23a0066511f8337bd88d9 No Types Assigned https://git.kernel.org/stable/c/50d8009a0ac02c3311b23a0066511f8337bd88d9 Patch Changed Reference Type https://git.kernel.org/stable/c/650e24748e1e0a7ff91d5c72b72a2f2a452b5b76 No Types Assigned https://git.kernel.org/stable/c/650e24748e1e0a7ff91d5c72b72a2f2a452b5b76 Patch Changed Reference Type https://git.kernel.org/stable/c/7b379353e9144e1f7460ff15f39862012c9d0d78 No Types Assigned https://git.kernel.org/stable/c/7b379353e9144e1f7460ff15f39862012c9d0d78 Patch Changed Reference Type https://git.kernel.org/stable/c/fba8334721e266f92079632598e46e5f89082f30 No Types Assigned https://git.kernel.org/stable/c/fba8334721e266f92079632598e46e5f89082f30 Patch Added CWE NIST NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 6.1.105 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.46 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.10.5 -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 04, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs with 0 consumed strides for the same WQE even after the WQE is fully consumed and unlinked. This triggers an additional unlink for the same wqe which corrupts the linked list. Fix this scenario by accepting 0 sized consumed strides without unlinking the WQE again. Added Reference kernel.org https://git.kernel.org/stable/c/7b379353e9144e1f7460ff15f39862012c9d0d78 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/650e24748e1e0a7ff91d5c72b72a2f2a452b5b76 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/50d8009a0ac02c3311b23a0066511f8337bd88d9 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/fba8334721e266f92079632598e46e5f89082f30 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-44970 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-44970
weaknesses.