CVE-2024-35981

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

virtio_net: Do not send RSS key if it is not supported

There is a bug when setting the RSS options in virtio_net that can break

the whole machine, getting the kernel into an infinite loop.

Running the following command in any QEMU virtual machine with virtionet

will reproduce this problem:

# ethtool -X eth0 hfunc toeplitz

This is how the problem happens:

1) ethtool_set_rxfh() calls virtnet_set_rxfh()

2) virtnet_set_rxfh() calls virtnet_commit_rss_command()

3) virtnet_commit_rss_command() populates 4 entries for the rss

scatter-gather

4) Since the command above does not have a key, then the last

scatter-gatter entry will be zeroed, since rss_key_size == 0.

sg_buf_size = vi->rss_key_size;

5) This buffer is passed to qemu, but qemu is not happy with a buffer

with zero length, and do the following in virtqueue_map_desc() (QEMU

function):

if (!sz) {

virtio_error(vdev, "virtio: zero sized buffers are

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References