Look up another CVE · open CVE-2024-46834 in the interactive tracker
CVE-2024-46834
ethtool: fail closed if we can't get max channel used in indirection tables
Published 2024-09-27 (2 years ago) by the Linux kernel CNA. Subsystem net/ethtool. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2024-46834 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.10.11-1 | Update the kernel and reboot. Fixed in 6.10.11-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.10.11-1 | Update the kernel and reboot. Fixed in 6.10.11-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.10.11-1 | Update the kernel and reboot. Fixed in 6.10.11-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Commit 0d1b7d6c9274 ("bnxt: fix crashes when reducing ring count with active RSS contexts") proves that allowing indirection table to contain channels with out of bounds IDs may lead to crashes. Currently the max channel check in the core gets skipped if driver can't fetch the indirection table or when we can't allocate memory. Both of those conditions should be extremely rare but if they do happen we should try to be safe and fail the channel change.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/ethtool/channels.c
net/ethtool/common.c
net/ethtool/common.h
net/ethtool/ioctl.c
- What this is
- NETWORKING [ETHTOOL]MAINTAINERS section matched on net/ethtool/
Check it on the machine
grep -w CONFIG_ETHTOOL_NETLINK /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_ETHTOOL_NETLINK
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2024-09-27 (2 years ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.22%, higher than 11.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/ethtool
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.6 | 6.10.10 | 101737d8b88d |
| 4.6 | 6.11 | 2899d58462ba |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is reached only through the ethtool ioctl (`SIOCETHTOOL`/`ETHTOOL_SCHANNELS`) or the ethtool generic-netlink socket (`ETHTOOL_MSG_CHANNELS_SET`), both of which require a local process on the machine. No remote peer input reaches this code.
- AC:LAttack complexity, low
- The attacker fully controls the indirection table contents and the channel-reduction request, and the only uncontrolled element — the helper returning an error — is attacker-influenceable via heap exhaustion against the `GFP_USER`/`GFP_KERNEL` allocations or by racing a device reset, and the operation can be retried in a tight loop until it lands.
- PR:LPrivileges required, low
- Both entry points gate on `ns_capable(net->user_ns, CAP_NET_ADMIN)`, a namespaced check, so an unprivileged user holding CAP_NET_ADMIN over a network namespace containing an RSS-capable netdev (the standard SR-IOV VF-in-container deployment) qualifies. No real root in the initial namespace is needed.
- UI:NUser interaction, none
- The attacker performs every step — setting the RSS indirection table and issuing the channel change — with no action by any other user or administrator.
- S:UScope, unchanged
- The out-of-bounds access occurs in kernel heap memory within the same kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.
- C:HConfidentiality impact, high
- The stale indirection entries drive an out-of-bounds read of an array of large per-ring structures at an attacker-chosen index (`bp->rx_ring[j]` in `bnxt_fill_hw_rss_tbl_p5()`), reaching far beyond the allocation rather than a few bounded bytes, and the leaked values are pushed into the NIC's hardware RSS configuration.
- I:HIntegrity impact, high
- Out-of-bounds heap data is programmed as firmware ring identifiers into the device's RSS indirection table, causing the NIC to DMA received packets into rings that no longer exist or are no longer owned by that context — device-side memory corruption leveraged from an attacker-controlled index.
- A:HAvailability impact, high
- The referenced bnxt commit documents outright crashes ("fix crashes when reducing ring count with active RSS contexts") with a KASAN slab-out-of-bounds splat during `__bnxt_open_nic()`, and misprogramming the hardware RSS table also breaks receive processing on the interface.