CVE-2024-36006

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36006

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage Both the function that migrates all the chunks within a region and the function that migrates all the entries within a chunk call list_first_entry() on the respective lists without checking that the lists are not empty. This is incorrect usage of the API, which leads to the following warning [1]. Fix by returning if the lists are empty as there is nothing to migrate in this case. [1] WARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0> Modules linked in: CPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0x2c0 [...] Call Trace: <TASK> mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x4a0 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>

References
Link Resource
https://git.kernel.org/stable/c/09846c2309b150b8ce4e0ce96f058197598fc530 Patch
https://git.kernel.org/stable/c/0b2c13b670b168e324e1cf109e67056a20fd610a Patch
https://git.kernel.org/stable/c/4526a56e02da3725db979358964df9cd9c567154 Patch
https://git.kernel.org/stable/c/64435b64e43d8ee60faa46c0cd04e323e8b2a7b0 Patch
https://git.kernel.org/stable/c/ab4ecfb627338e440ae11def004c524a00d93e40 Patch
https://git.kernel.org/stable/c/af8b593c3dd9df82cb199be65863af004b09fd97 Patch
https://git.kernel.org/stable/c/b377add0f0117409c418ddd6504bd682ebe0bf79 Patch
https://git.kernel.org/stable/c/09846c2309b150b8ce4e0ce96f058197598fc530 Patch
https://git.kernel.org/stable/c/0b2c13b670b168e324e1cf109e67056a20fd610a Patch
https://git.kernel.org/stable/c/4526a56e02da3725db979358964df9cd9c567154 Patch
https://git.kernel.org/stable/c/64435b64e43d8ee60faa46c0cd04e323e8b2a7b0 Patch
https://git.kernel.org/stable/c/ab4ecfb627338e440ae11def004c524a00d93e40 Patch
https://git.kernel.org/stable/c/af8b593c3dd9df82cb199be65863af004b09fd97 Patch
https://git.kernel.org/stable/c/b377add0f0117409c418ddd6504bd682ebe0bf79 Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Third Party Advisory Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

17 Dec 2025, 03:33

Type Values Removed Values Added
First Time Linux linux Kernel
Debian
Linux
Debian debian Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/09846c2309b150b8ce4e0ce96f058197598fc530 - () https://git.kernel.org/stable/c/09846c2309b150b8ce4e0ce96f058197598fc530 - Patch
References () https://git.kernel.org/stable/c/0b2c13b670b168e324e1cf109e67056a20fd610a - () https://git.kernel.org/stable/c/0b2c13b670b168e324e1cf109e67056a20fd610a - Patch
References () https://git.kernel.org/stable/c/4526a56e02da3725db979358964df9cd9c567154 - () https://git.kernel.org/stable/c/4526a56e02da3725db979358964df9cd9c567154 - Patch
References () https://git.kernel.org/stable/c/64435b64e43d8ee60faa46c0cd04e323e8b2a7b0 - () https://git.kernel.org/stable/c/64435b64e43d8ee60faa46c0cd04e323e8b2a7b0 - Patch
References () https://git.kernel.org/stable/c/ab4ecfb627338e440ae11def004c524a00d93e40 - () https://git.kernel.org/stable/c/ab4ecfb627338e440ae11def004c524a00d93e40 - Patch
References () https://git.kernel.org/stable/c/af8b593c3dd9df82cb199be65863af004b09fd97 - () https://git.kernel.org/stable/c/af8b593c3dd9df82cb199be65863af004b09fd97 - Patch
References () https://git.kernel.org/stable/c/b377add0f0117409c418ddd6504bd682ebe0bf79 - () https://git.kernel.org/stable/c/b377add0f0117409c418ddd6504bd682ebe0bf79 - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Third Party Advisory, Mailing List
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo

21 Nov 2024, 09:21

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
References () https://git.kernel.org/stable/c/09846c2309b150b8ce4e0ce96f058197598fc530 - () https://git.kernel.org/stable/c/09846c2309b150b8ce4e0ce96f058197598fc530 -
References () https://git.kernel.org/stable/c/0b2c13b670b168e324e1cf109e67056a20fd610a - () https://git.kernel.org/stable/c/0b2c13b670b168e324e1cf109e67056a20fd610a -
References () https://git.kernel.org/stable/c/4526a56e02da3725db979358964df9cd9c567154 - () https://git.kernel.org/stable/c/4526a56e02da3725db979358964df9cd9c567154 -
References () https://git.kernel.org/stable/c/64435b64e43d8ee60faa46c0cd04e323e8b2a7b0 - () https://git.kernel.org/stable/c/64435b64e43d8ee60faa46c0cd04e323e8b2a7b0 -
References () https://git.kernel.org/stable/c/ab4ecfb627338e440ae11def004c524a00d93e40 - () https://git.kernel.org/stable/c/ab4ecfb627338e440ae11def004c524a00d93e40 -
References () https://git.kernel.org/stable/c/af8b593c3dd9df82cb199be65863af004b09fd97 - () https://git.kernel.org/stable/c/af8b593c3dd9df82cb199be65863af004b09fd97 -
References () https://git.kernel.org/stable/c/b377add0f0117409c418ddd6504bd682ebe0bf79 - () https://git.kernel.org/stable/c/b377add0f0117409c418ddd6504bd682ebe0bf79 -

05 Nov 2024, 10:17

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

25 Jun 2024, 22:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mlxsw: espectro_acl_tcam: corrige el uso incorrecto de la API de lista. Tanto la función que migra todos los fragmentos dentro de una región como la función que migra todas las entradas dentro de un fragmento llaman a list_first_entry() en el respectivo listas sin verificar que las listas no estén vacías. Este es un uso incorrecto de la API, lo que genera la siguiente advertencia [1]. Para solucionarlo, regrese si las listas están vacías, ya que en este caso no hay nada que migrar. [1] ADVERTENCIA: CPU: 0 PID: 6437 en drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0&gt; Módulos vinculados en: CPU: 0 PID: 6437 Comm: kworker/0:37 No contaminado 6.9.0-rc3-custom-00883-g94a65f079ef6 #39 Nombre del hardware: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 06/01/2019 Cola de trabajo: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP 0010:mlxsw_sp _acl_tcam_vchunk_migrate_all+0x1f1/0x2c0 [... ] Seguimiento de llamadas: mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x4a0 Process_one_work+0x151/0x370 Workers_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x3 0

20 May 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-20 10:15

Updated : 2025-12-17 03:33

NVD link : CVE-2024-36006

Mitre link : CVE-2024-36006

CVE.ORG link : CVE-2024-36006

JSON object : View

Products Affected

linux

debian

CWE
NVD-CWE-noinfo