CVE-2024-42083

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ionic: fix kernel panic due to multi-buffer handling

Currently, the ionic_run_xdp() doesn't handle multi-buffer packets

properly for XDP_TX and XDP_REDIRECT.

When a jumbo frame is received, the ionic_run_xdp() first makes xdp

frame with all necessary pages in the rx descriptor.

And if the action is either XDP_TX or XDP_REDIRECT, it should unmap

dma-mapping and reset page pointer to NULL for all pages, not only the

first page.

But it doesn't for SG pages. So, SG pages unexpectedly will be reused.

It eventually causes kernel panic.

Oops: general protection fault, probably for non-canonical address 0x504f4e4dbebc64ff: 0000 [#1] PREEMPT SMP NOPTI

CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.10.0-rc3+ #25

RIP: 0010:xdp_return_frame+0x42/0x90

Code: 01 75 12 5b 4c 89 e6 5d 31 c9 41 5c 31 d2 41 5d e9 73 fd ff ff 44 8b 6b 20 0f b7 43 0a 49 81 ed 68 01 00 00 49 29 c5 49 01 fd <41> 80 7d0

RSP: 0018:ffff99d00122ce08 EFLAGS: 0001

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References