CVE-2024-46799 in Linux
Summary
by MITRE • 09/18/2024
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: ti: am65-cpsw: Fix NULL dereference on XDP_TX
If number of TX queues are set to 1 we get a NULL pointer dereference during XDP_TX.
~# ethtool -L eth0 tx 1 ~# ./xdp-trafficgen udp -A -a eth0 -t 2 Transmitting on eth0 (ifindex 2) [ 241.135257] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030
Fix this by using actual TX queues instead of max TX queues when picking the TX channel in am65_cpsw_ndo_xdp_xmit().
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/06/2026
The vulnerability CVE-2024-46799 represents a critical NULL pointer dereference flaw in the Linux kernel's TI AM65 CPSW network driver implementation. This issue specifically affects the ethernet subsystem when operating with XDP (eXpress Data Path) traffic processing, creating a potential system crash scenario that can be exploited by malicious actors. The flaw manifests when the transmit queue configuration is set to a single queue, which triggers an invalid memory access pattern during XDP_TX operations. The vulnerability stems from improper queue management logic within the driver's XDP transmission handling mechanism, where the code incorrectly references max TX queues instead of actual TX queues during channel selection.
The technical implementation of this vulnerability occurs within the am65_cpsw_ndo_xdp_xmit() function, where the driver fails to properly validate queue references when processing XDP transmit operations. When ethtool is used to configure a single transmit queue on the eth0 interface, the driver's internal logic attempts to access memory at virtual address 0x30, which corresponds to a NULL pointer dereference. This condition violates fundamental kernel memory safety principles and can lead to immediate system instability or complete system crashes. The flaw specifically relates to improper resource allocation and queue management in the context of XDP operations, where the driver assumes the existence of multiple queues when only one is actually configured.
The operational impact of this vulnerability extends beyond simple system crashes, as it can be leveraged to cause denial of service attacks against networked systems. Attackers can exploit this weakness by configuring network interfaces with single transmit queues and then initiating XDP_TX operations through tools like xdp-trafficgen, effectively triggering the NULL pointer dereference. This vulnerability affects systems running Linux kernels with TI AM65 CPSW driver implementations, particularly those utilizing XDP for high-performance packet processing. The flaw demonstrates a clear violation of the principle of least privilege and proper resource validation, as the driver fails to validate queue configurations before attempting memory access operations. Organizations using embedded systems, industrial networks, or any infrastructure relying on TI AM65 CPSW hardware for ethernet connectivity face significant risk from this vulnerability.
Mitigation strategies for CVE-2024-46799 primarily involve applying the kernel patch that corrects the queue reference logic by ensuring that actual TX queues are used instead of max TX queues when selecting TX channels. System administrators should prioritize updating their kernel versions to include the fix, particularly in production environments where XDP operations are actively used. Additionally, monitoring for XDP traffic patterns and implementing proper queue configuration validation can help detect potential exploitation attempts. The fix addresses the underlying CWE-476 NULL pointer dereference issue, which is categorized under the Common Weakness Enumeration framework, and aligns with ATT&CK technique T1499.004 for network disruption through system resource exhaustion. Organizations should also consider implementing network segmentation and access controls to limit potential exploitation paths, as this vulnerability can be leveraged to cause system instability and service disruption in targeted environments.