CVE-2024-36006

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_acl_tcam: Fix incorrect list API usage

Both the function that migrates all the chunks within a region and the

function that migrates all the entries within a chunk call

list_first_entry() on the respective lists without checking that the

lists are not empty. This is incorrect usage of the API, which leads to

the following warning [1].

Fix by returning if the lists are empty as there is nothing to migrate

in this case.

[1]

WARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0>

Modules linked in:

CPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39

Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019

Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work

RIP: 0010:mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0x2c0

[...]

Call Trace:

<TASK>

mlxsw_sp_acl_tc

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References