CVE-2024-46717

net/mlx5e: SHAMPO, Fix incorrect page release

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1) No skb created yet 2) header_size == 0 (no SHAMPO header) 3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the last page fragment of a SHAMPO header page) a new skb is formed with a page that is NOT a SHAMPO header page (it is a regular data page). Further down in the same function (mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from header_index is released. This is wrong and it leads to SHAMPO header pages being released more than once.

N/A

CVSS

Severity:

EPSS 0.08%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/03924d117625ecb10ee3c9b65930bcb2c37ae629
https://git.kernel.org/stable/c/ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab
https://git.kernel.org/stable/c/c909ab41df2b09cde919801c7a7b6bb2cc37ea22
https://git.kernel.org/stable/c/70bd03b89f20b9bbe51a7f73c4950565a17a45f7

Frequently Asked Questions

What is the severity of CVE-2024-46717?: CVE-2024-46717 has not yet been assigned a CVSS score.
How to fix CVE-2024-46717?: To fix CVE-2024-46717, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-46717 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-46717 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-46717?: CVE-2024-46717 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.