CVE-2024-49953

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice

The km.state is not checked in driver's delayed work. When

xfrm_state_check_expire() is called, the state can be reset to

XFRM_STATE_EXPIRED, even if it is XFRM_STATE_DEAD already. This

happens when xfrm state is deleted, but not freed yet. As

__xfrm_state_delete() is called again in xfrm timer, the following

crash occurs.

To fix this issue, skip xfrm_state_check_expire() if km.state is not

XFRM_STATE_VALID.

Oops: general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP

CPU: 5 UID: 0 PID: 7448 Comm: kworker/u102:2 Not tainted 6.11.0-rc2+ #1

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014

Workqueue: mlx5e_ipsec: eth%d mlx5e_ipsec_handle_sw_limits [mlx5_core]

RIP: 0010:__xfrm_state_delete+0x3d/0x1b0

Code: 0f 84 8b 01 00 00 48 89 fd c6 87 c8 00

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References