CVE-2024-26853

CVE Details

Release Date:

2024-04-17

Description

In the Linux kernel, the following vulnerability has been resolved:\nigc: avoid returning frame twice in XDP_REDIRECT\nWhen a frame can not be transmitted in XDP_REDIRECT\n(e.g. due to a full queue), it is necessary to free\nit by calling xdp_return_frame_rx_napi.\nHowever, this is the responsibility of the caller of\nthe ndo_xdp_xmit (see for example bq_xmit_all in\nkernel/bpf/devmap.c) and thus calling it inside\nigc_xdp_xmit (which is the ndo_xdp_xmit of the igc\ndriver) as well will lead to memory corruption.\nIn fact, bq_xmit_all expects that it can return all\nframes after the last successfully transmitted one.\nTherefore, break for the first not transmitted frame,\nbut do not call xdp_return_frame_rx_napi in igc_xdp_xmit.\nThis is equally implemented in other Intel drivers\nsuch as the igb.\nThere are two alternatives to this that were rejected:\n1. Return num_frames as all the frames would have been\ntransmitted and release them inside igc_xdp_xmit.\nWhile it might work technically, it is not what\nthe return value is meant to represent (i.e. the\nnumber of SUCCESSFULLY transmitted packets).\n2. Rework kernel/bpf/devmap.c and all drivers to\nsupport non-consecutively dropped packets.\nBesides being complex, it likely has a negative\nperformance impact without a significant gain\nsince it is anyway unlikely that the next frame\ncan be transmitted if the previous one was dropped.\nThe memory corruption can be reproduced with\nthe following script which leads to a kernel panic\nafter a few seconds. It basically generates more\ntraffic than a i225 NIC can transmit and pushes it\nvia XDP_REDIRECT from a virtual interface to the\nphysical interface where frames get dropped.\n#!/bin/bash\nINTERFACE=enp4s0\nINTERFACE_IDX=`cat /sys/class/net//ifindex`\nsudo ip link add dev veth1 type veth peer name veth2\nsudo ip link set up \nsudo ip link set up veth1\nsudo ip link set up veth2\ncat << EOF > redirect.bpf.c\nSEC('prog')\nint redirect(struct xdp_md *ctx)\n{\nreturn bpf_redirect(, 0);\n}\nchar _license[] SEC('license') = 'GPL';\nEOF\nclang -O2 -g -Wall -target bpf -c redirect.bpf.c -o redirect.bpf.o\nsudo ip link set veth2 xdp obj redirect.bpf.o\ncat << EOF > pass.bpf.c\nSEC('prog')\nint pass(struct xdp_md *ctx)\n{\nreturn XDP_PASS;\n}\nchar _license[] SEC('license') = 'GPL';\nEOF\nclang -O2 -g -Wall -target bpf -c pass.bpf.c -o pass.bpf.o\nsudo ip link set xdp obj pass.bpf.o\ncat << EOF > trafgen.cfg\n{\n/* Ethernet Header */\n0xe8, 0x6a, 0x64, 0x41, 0xbf, 0x46,\n0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,\nconst16(ETH_P_IP),\n/* IPv4 Header */\n0b01000101, 0, # IPv4 version, IHL, TOS\nconst16(1028), # IPv4 total length (UDP length + 20 bytes (IP header))\nconst16(2), # IPv4 ident\n0b01000000, 0, # IPv4 flags, fragmentation off\n64, # IPv4 TTL\n17, # Protocol UDP\ncsumip(14, 33), # IPv4 checksum\n/* UDP Header */\n10, 0, 1, 1, # IP Src - adapt as needed\n10, 0, 1, 2, # IP Dest - adapt as needed\nconst16(6666), # UDP Src Port\nconst16(6666), # UDP Dest Port\nconst16(1008), # UDP length (UDP header 8 bytes + payload length)\ncsumudp(14, 34), # UDP checksum\n/* Payload */\nfill('W', 1000),\n}\nEOF\nsudo trafgen -i trafgen.cfg -b3000MB -o veth1 --cpp

See more information about CVE-2024-26853 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	4.4	CVSS Vector:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack Vector:	Local network	Attack Complexity:	Low
Privileges Required:	High	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (kernel)	ELSA-2024-5101	2024-08-08
Oracle Linux version 9 (kernel)	ELSA-2024-5363	2024-08-14