CVE-2024-56788

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: oa_tc6: fix tx skb race condition between reference pointers

There are two skb pointers to manage tx skb's enqueued from n/w stack.

waiting_tx_skb pointer points to the tx skb which needs to be processed

and ongoing_tx_skb pointer points to the tx skb which is being processed.

SPI thread prepares the tx data chunks from the tx skb pointed by the

ongoing_tx_skb pointer. When the tx skb pointed by the ongoing_tx_skb is

processed, the tx skb pointed by the waiting_tx_skb is assigned to

ongoing_tx_skb and the waiting_tx_skb pointer is assigned with NULL.

Whenever there is a new tx skb from n/w stack, it will be assigned to

waiting_tx_skb pointer if it is NULL. Enqueuing and processing of a tx skb

handled in two different threads.

Consider a scenario where the SPI thread processed an ongoing_tx_skb and

it moves next tx skb from waiting_tx_skb pointer to ongoing_tx_skb pointer

without doing any NULL check.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References