CVE-2024-50261

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

macsec: Fix use-after-free while sending the offloading packet

KASAN reports the following UAF. The metadata_dst, which is used to

store the SCI value for macsec offload, is already freed by

metadata_dst_free() in macsec_free_netdev(), while driver still use it

for sending the packet.

To fix this issue, dst_release() is used instead to release

metadata_dst. So it is not freed instantly in macsec_free_netdev() if

still referenced by skb.

BUG: KASAN: slab-use-after-free in mlx5e_xmit+0x1e8f/0x4190 [mlx5_core]

Read of size 2 at addr ffff88813e42e038 by task kworker/7:2/714

[...]

Workqueue: mld mld_ifc_work

Call Trace:

<TASK>

dump_stack_lvl+0x51/0x60

print_report+0xc1/0x600

kasan_report+0xab/0xe0

mlx5e_xmit+0x1e8f/0x4190 [mlx5_core]

dev_hard_start_xmit+0x120/0x530

sch_direct_xmit+0x149/0x11e0

__qdisc_run+0x3ad/0x1730

__dev_queue_xmit+0x1196/0x2ed0

vlan_dev_hard_start_xmit+0x32e/0x510 [8021q]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References