CVE-2024-36281— net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-36281
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules rx_create no longer allocates a modify_hdr instance that needs to be cleaned up. The mlx5_modify_header_dealloc call will lead to a NULL pointer dereference. A leak in the rules also previously occurred since there are now two rules populated related to status. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 109907067 P4D 109907067 PUD 116890067 PMD 0 Oops: 0000 [#1] SMP CPU: 1 PID: 484 Comm: ip Not tainted 6.9.0-rc2-rrameshbabu+ #254 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Arch Linux 1.16.3-1-1 04/01/2014 RIP: 0010:mlx5_modify_header_dealloc+0xd/0x70 <snip> Call Trace: <TASK> ? show_regs+0x60/0x70 ? __die+0x24/0x70 ? page_fault_oops+0x15f/0x430 ? free_to_partial_list.constprop.0+0x79/0x150 ? do_user_addr_fault+0x2c9/0x5c0 ? exc_page_fault+0x63/0x110 ? asm_exc_page_fault+0x27/0x30 ? mlx5_modify_header_dealloc+0xd/0x70 rx_create+0x374/0x590 rx_add_rule+0x3ad/0x500 ? rx_add_rule+0x3ad/0x500 ? mlx5_cmd_exec+0x2c/0x40 ? mlx5_create_ipsec_obj+0xd6/0x200 mlx5e_accel_ipsec_fs_add_rule+0x31/0xf0 mlx5e_xfrm_add_state+0x426/0xc00 <snip>
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于net/mlx5模块存在问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-36281
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-36281
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-06-21 · 40 CVEs total
| CVE-2024-38636 | f2fs: multidev: fix to recognize valid zero block address | |
| CVE-2024-38627 | stm class: Fix a double free in stm_register_device() | |
| CVE-2024-38628 | usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind. | |
| CVE-2024-38629 | dmaengine: idxd: Avoid unnecessary destruction of file_ida | |
| CVE-2024-38630 | watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger | |
| CVE-2024-38631 | iio: adc: PAC1934: fix accessing out of bounds array index | |
| CVE-2024-38632 | vfio/pci: fix potential memory leak in vfio_intx_enable() | |
| CVE-2024-38633 | serial: max3100: Update uart_driver_registered on driver removal | |
| CVE-2024-38634 | serial: max3100: Lock port->lock when calling uart_handle_cts_change() | |
| CVE-2024-38635 | soundwire: cadence: fix invalid PDI offset | |
| CVE-2024-38625 | fs/ntfs3: Check 'folio' pointer for NULL | |
| CVE-2024-38637 | greybus: lights: check return of get_channel_from_mode | |
| CVE-2024-38659 | enic: Validate length of nl attributes in enic_set_vf_port | |
| CVE-2024-38662 | bpf: Allow delete from sockmap/sockhash only if update is allowed | |
| CVE-2024-38780 | dma-buf/sw-sync: don't enable IRQ from sync_print_obj() | |
| CVE-2024-39277 | dma-mapping: benchmark: handle NUMA_NO_NODE correctly | |
| CVE-2024-34777 | dma-mapping: benchmark: fix node id validation | |
| CVE-2024-36288 | SUNRPC: Fix loop termination condition in gss_free_in_token_pages() | |
| CVE-2024-36477 | tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer | |
| CVE-2024-36481 | tracing/probes: fix error check in parse_btf_field() |
Showing top 20 of 40 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length - CVE-2026-43489
liveupdate: luo_file: remember retrieve() status - CVE-2026-43487
ata: libata-core: Disable LPM on ST1000DM010-2EP102 - CVE-2026-43488
usb: xhci: Prevent interrupt storm on host controller error
Same vendor: Linux
- CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length - CVE-2026-43489
liveupdate: luo_file: remember retrieve() status - CVE-2026-43487
ata: libata-core: Disable LPM on ST1000DM010-2EP102 - CVE-2026-43488
usb: xhci: Prevent interrupt storm on host controller error
V. Comments for CVE-2024-36281
No comments yet