CVE-2024-35958

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35958

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: net: ena: Fix incorrect descriptor free behavior ENA has two types of TX queues: - queues which only process TX packets arriving from the network stack - queues which only process TX packets forwarded to it by XDP_REDIRECT or XDP_TX instructions The ena_free_tx_bufs() cycles through all descriptors in a TX queue and unmaps + frees every descriptor that hasn't been acknowledged yet by the device (uncompleted TX transactions). The function assumes that the processed TX queue is necessarily from the first category listed above and ends up using napi_consume_skb() for descriptors belonging to an XDP specific queue. This patch solves a bug in which, in case of a VF reset, the descriptors aren't freed correctly, leading to crashes.

References
Link Resource
https://git.kernel.org/stable/c/19ff8fed3338898b70b2aad831386c78564912e1 Patch
https://git.kernel.org/stable/c/5c7f2240d9835a7823d87f7460d8eae9f4e504c7 Patch
https://git.kernel.org/stable/c/b26aa765f7437e1bbe8db4c1641b12bd5dd378f0 Patch
https://git.kernel.org/stable/c/bf02d9fe00632d22fa91d34749c7aacf397b6cde Patch
https://git.kernel.org/stable/c/c31baa07f01307b7ae05f3ce32b89d8e2ba0cc1d Patch
https://git.kernel.org/stable/c/fdfbf54d128ab6ab255db138488f9650485795a2 Patch
https://git.kernel.org/stable/c/19ff8fed3338898b70b2aad831386c78564912e1 Patch
https://git.kernel.org/stable/c/5c7f2240d9835a7823d87f7460d8eae9f4e504c7 Patch
https://git.kernel.org/stable/c/b26aa765f7437e1bbe8db4c1641b12bd5dd378f0 Patch
https://git.kernel.org/stable/c/bf02d9fe00632d22fa91d34749c7aacf397b6cde Patch
https://git.kernel.org/stable/c/c31baa07f01307b7ae05f3ce32b89d8e2ba0cc1d Patch
https://git.kernel.org/stable/c/fdfbf54d128ab6ab255db138488f9650485795a2 Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Third Party Advisory Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

17 Dec 2025, 03:37

Type Values Removed Values Added
CWE NVD-CWE-noinfo
References () https://git.kernel.org/stable/c/19ff8fed3338898b70b2aad831386c78564912e1 - () https://git.kernel.org/stable/c/19ff8fed3338898b70b2aad831386c78564912e1 - Patch
References () https://git.kernel.org/stable/c/5c7f2240d9835a7823d87f7460d8eae9f4e504c7 - () https://git.kernel.org/stable/c/5c7f2240d9835a7823d87f7460d8eae9f4e504c7 - Patch
References () https://git.kernel.org/stable/c/b26aa765f7437e1bbe8db4c1641b12bd5dd378f0 - () https://git.kernel.org/stable/c/b26aa765f7437e1bbe8db4c1641b12bd5dd378f0 - Patch
References () https://git.kernel.org/stable/c/bf02d9fe00632d22fa91d34749c7aacf397b6cde - () https://git.kernel.org/stable/c/bf02d9fe00632d22fa91d34749c7aacf397b6cde - Patch
References () https://git.kernel.org/stable/c/c31baa07f01307b7ae05f3ce32b89d8e2ba0cc1d - () https://git.kernel.org/stable/c/c31baa07f01307b7ae05f3ce32b89d8e2ba0cc1d - Patch
References () https://git.kernel.org/stable/c/fdfbf54d128ab6ab255db138488f9650485795a2 - () https://git.kernel.org/stable/c/fdfbf54d128ab6ab255db138488f9650485795a2 - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Third Party Advisory, Mailing List
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
First Time Linux linux Kernel
Debian
Linux
Debian debian Linux

21 Nov 2024, 09:21

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
References () https://git.kernel.org/stable/c/19ff8fed3338898b70b2aad831386c78564912e1 - () https://git.kernel.org/stable/c/19ff8fed3338898b70b2aad831386c78564912e1 -
References () https://git.kernel.org/stable/c/5c7f2240d9835a7823d87f7460d8eae9f4e504c7 - () https://git.kernel.org/stable/c/5c7f2240d9835a7823d87f7460d8eae9f4e504c7 -
References () https://git.kernel.org/stable/c/b26aa765f7437e1bbe8db4c1641b12bd5dd378f0 - () https://git.kernel.org/stable/c/b26aa765f7437e1bbe8db4c1641b12bd5dd378f0 -
References () https://git.kernel.org/stable/c/bf02d9fe00632d22fa91d34749c7aacf397b6cde - () https://git.kernel.org/stable/c/bf02d9fe00632d22fa91d34749c7aacf397b6cde -
References () https://git.kernel.org/stable/c/c31baa07f01307b7ae05f3ce32b89d8e2ba0cc1d - () https://git.kernel.org/stable/c/c31baa07f01307b7ae05f3ce32b89d8e2ba0cc1d -
References () https://git.kernel.org/stable/c/fdfbf54d128ab6ab255db138488f9650485795a2 - () https://git.kernel.org/stable/c/fdfbf54d128ab6ab255db138488f9650485795a2 -

05 Nov 2024, 10:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

31 Oct 2024, 21:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

25 Jun 2024, 21:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: ena: soluciona el comportamiento incorrecto sin descriptor. ENA tiene dos tipos de colas TX: - colas que solo procesan paquetes TX que llegan desde la pila de red - colas que solo procesan paquetes TX reenviados a mediante instrucciones XDP_REDIRECT o XDP_TX. Ena_free_tx_bufs() recorre todos los descriptores en una cola de TX y desasigna + libera todos los descriptores que aún no han sido reconocidos por el dispositivo (transacciones de TX incompletas). La función supone que la cola TX procesada es necesariamente de la primera categoría enumerada anteriormente y termina usando napi_consume_skb() para los descriptores que pertenecen a una cola XDP específica. Este parche resuelve un error por el cual, en caso de restablecer VF, los descriptores no se liberan correctamente, lo que provoca fallos.

20 May 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-20 10:15

Updated : 2025-12-17 03:37

NVD link : CVE-2024-35958

Mitre link : CVE-2024-35958

CVE.ORG link : CVE-2024-35958

JSON object : View

Products Affected

linux

debian

CWE
NVD-CWE-noinfo