CVE-2024-58099

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame

Andrew and Nikolay reported connectivity issues with Cilium's service

load-balancing in case of vmxnet3.

If a BPF program for native XDP adds an encapsulation header such as

IPIP and transmits the packet out the same interface, then in case

of vmxnet3 a corrupted packet is being sent and subsequently dropped

on the path.

vmxnet3_xdp_xmit_frame() which is called e.g. via vmxnet3_run_xdp()

through vmxnet3_xdp_xmit_back() calculates an incorrect DMA address:

page = virt_to_page(xdpf->data);

tbi->dma_addr = page_pool_get_dma_addr(page) +

VMXNET3_XDP_HEADROOM;

dma_sync_single_for_device(&adapter->pdev->dev,

tbi->dma_addr, buf_size,

DMA_TO_DEVICE);

The above assumes a fixed offset (VMXNET3_XDP_HEADROOM), but the XDP

BPF program could have moved xdp->data. While the passed buf_size i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References