CVE-2024-35901

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Fix Rx DMA datasize and skb_over_panic

mana_get_rxbuf_cfg() aligns the RX buffer's DMA datasize to be

multiple of 64. So a packet slightly bigger than mtu+14, say 1536,

can be received and cause skb_over_panic.

Sample dmesg:

[ 5325.237162] skbuff: skb_over_panic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev:<NULL>

[ 5325.243689] ------------[ cut here ]------------

[ 5325.245748] kernel BUG at net/core/skbuff.c:192!

[ 5325.247838] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI

[ 5325.258374] RIP: 0010:skb_panic+0x4f/0x60

[ 5325.302941] Call Trace:

[ 5325.304389] <IRQ>

[ 5325.315794] ? skb_panic+0x4f/0x60

[ 5325.317457] ? asm_exc_invalid_op+0x1f/0x30

[ 5325.319490] ? skb_panic+0x4f/0x60

[ 5325.321161] skb_put+0x4e/0x50

[ 5325.322670] mana_poll+0x6fa/0xb50 [mana]

[ 5325.324578] __napi_poll+0x33/0x1e0

[ 5325.326328] net_rx_action+0x12e/0x28

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References