CVE-2024-43880

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_acl_erp: Fix object nesting warning

ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM

(A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can

contain more ACLs (i.e., tc filters), but the number of masks in each

region (i.e., tc chain) is limited.

In order to mitigate the effects of the above limitation, the device

allows filters to share a single mask if their masks only differ in up

to 8 consecutive bits. For example, dst_ip/25 can be represented using

dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the

number of masks being used (and therefore does not support mask

aggregation), but can contain a limited number of filters.

The driver uses the "objagg" library to perform the mask aggregation by

passing it objects that consist of the filter's mask and whether the

filter is to be inserted into the A-TCAM or the C-TCAM since filters in

different TCAM

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References