CVE-2024-26853

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

igc: avoid returning frame twice in XDP_REDIRECT

When a frame can not be transmitted in XDP_REDIRECT

(e.g. due to a full queue), it is necessary to free

it by calling xdp_return_frame_rx_napi.

However, this is the responsibility of the caller of

the ndo_xdp_xmit (see for example bq_xmit_all in

kernel/bpf/devmap.c) and thus calling it inside

igc_xdp_xmit (which is the ndo_xdp_xmit of the igc

driver) as well will lead to memory corruption.

In fact, bq_xmit_all expects that it can return all

frames after the last successfully transmitted one.

Therefore, break for the first not transmitted frame,

but do not call xdp_return_frame_rx_napi in igc_xdp_xmit.

This is equally implemented in other Intel drivers

such as the igb.

There are two alternatives to this that were rejected:

1. Return num_frames as all the frames would have been

transmitted and release them inside igc_xdp_xmit.

While it might work technically, it

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References