CVE-2024-50041

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix macvlan leak by synchronizing access to mac_filter_hash

This patch addresses a macvlan leak issue in the i40e driver caused by

concurrent access to vsi->mac_filter_hash. The leak occurs when multiple

threads attempt to modify the mac_filter_hash simultaneously, leading to

inconsistent state and potential memory leaks.

To fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing

vf->default_lan_addr.addr with spin_lock/unlock_bh(&vsi->mac_filter_hash_lock),

ensuring atomic operations and preventing concurrent access.

Additionally, we add lockdep_assert_held(&vsi->mac_filter_hash_lock) in

i40e_add_mac_filter() to help catch similar issues in the future.

Reproduction steps:

1. Spawn VFs and configure port vlan on them.

2. Trigger concurrent macvlan operations (e.g., adding and deleting

portvlan and/or mac filters).

3. Observe the potential memory leak and inconsistent state in the

mac_filter_ha

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References