CVE-2024-40923

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vmxnet3: disable rx data ring on dma allocation failure

When vmxnet3_rq_create() fails to allocate memory for rq->data_ring.base,

the subsequent call to vmxnet3_rq_destroy_all_rxdataring does not reset

rq->data_ring.desc_size for the data ring that failed, which presumably

causes the hypervisor to reference it on packet reception.

To fix this bug, rq->data_ring.desc_size needs to be set to 0 to tell

the hypervisor to disable this feature.

[ 95.436876] kernel BUG at net/core/skbuff.c:207!

[ 95.439074] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI

[ 95.440411] CPU: 7 PID: 0 Comm: swapper/7 Not tainted 6.9.3-dirty #1

[ 95.441558] Hardware name: VMware, Inc. VMware Virtual

Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

[ 95.443481] RIP: 0010:skb_panic+0x4d/0x4f

[ 95.444404] Code: 4f 70 50 8b 87 c0 00 00 00 50 8b 87 bc 00 00 00 50

ff b7 d0 00 00 00 4c 8b 8f c8 00 00 00 48 c7 c7 68 e8 be 9f e8

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References