CVE-2024-35901

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35901
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix Rx DMA datasize and skb_over_panic mana_get_rxbuf_cfg() aligns the RX buffer's DMA datasize to be multiple of 64. So a packet slightly bigger than mtu+14, say 1536, can be received and cause skb_over_panic. Sample dmesg: [ 5325.237162] skbuff: skb_over_panic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev:<NULL> [ 5325.243689] ------------[ cut here ]------------ [ 5325.245748] kernel BUG at net/core/skbuff.c:192! [ 5325.247838] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 5325.258374] RIP: 0010:skb_panic+0x4f/0x60 [ 5325.302941] Call Trace: [ 5325.304389] <IRQ> [ 5325.315794] ? skb_panic+0x4f/0x60 [ 5325.317457] ? asm_exc_invalid_op+0x1f/0x30 [ 5325.319490] ? skb_panic+0x4f/0x60 [ 5325.321161] skb_put+0x4e/0x50 [ 5325.322670] mana_poll+0x6fa/0xb50 [mana] [ 5325.324578] __napi_poll+0x33/0x1e0 [ 5325.326328] net_rx_action+0x12e/0x280 As discussed internally, this alignment is not necessary. To fix this bug, remove it from the code. So oversized packets will be marked as CQE_RX_TRUNCATED by NIC, and dropped.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b Patch
https://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246 Patch
https://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad Patch
https://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b Patch
https://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246 Patch
https://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
History

23 Sep 2025, 13:35

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b - () https://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b - Patch
References () https://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246 - () https://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246 - Patch
References () https://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad - () https://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad - Patch
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux

21 Nov 2024, 09:21

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: mana: Fix Rx DMA datasize y skb_over_panic mana_get_rxbuf_cfg() alinea el tamaño de datos DMA del buffer RX para que sea múltiplo de 64. Entonces, un paquete ligeramente más grande que mtu+14, digamos 1536, se puede recibir y causar skb_over_panic. Dmesg de muestra: [5325.237162] skbuff: skb_over_panic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev: [ 689] ----------- -[ cortar aquí ]------------ ¡BUG del kernel [5325.245748] en net/core/skbuff.c:192! [ 5325.247838] código de operación no válido: 0000 [#1] PREEMPT SMP NOPTI [ 5325.258374] RIP: 0010:skb_panic+0x4f/0x60 [ 5325.302941] Seguimiento de llamadas: [ 5325.304389] [ 5325.315794] ? skb_panic+0x4f/0x60 [5325.317457]? asm_exc_invalid_op+0x1f/0x30 [5325.319490]? skb_panic+0x4f/0x60 [ 5325.321161] skb_put+0x4e/0x50 [ 5325.322670] mana_poll+0x6fa/0xb50 [mana] [ 5325.324578] __napi_poll+0x33/0x1e0 [ 5325.326328 ] net_rx_action+0x12e/0x280 Como se analizó internamente, esta alineación no es necesaria. Para corregir este error, elimínelo del código. Por lo tanto, los paquetes de gran tamaño serán marcados como CQE_RX_TRUNCATED por NIC y descartados.
References () https://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b - () https://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b -
References () https://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246 - () https://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246 -
References () https://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad - () https://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad -

19 May 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-19 09:15

Updated : 2025-09-23 13:35

NVD link : CVE-2024-35901

Mitre link : CVE-2024-35901

CVE.ORG link : CVE-2024-35901

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime