Linux Kernel up to 6.10.9 Virtual Address /xdp-trafficgen am65_cpsw_ndo_xdp_xmit null pointer dereference

Summaryinfo

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 6.10.9. This affects the function am65_cpsw_ndo_xdp_xmit of the file /xdp-trafficgen of the component Virtual Address Handler. Executing a manipulation can lead to null pointer dereference. This vulnerability is tracked as CVE-2024-46799. Moreover, an exploit is present. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.10.9. It has been declared as problematic. This vulnerability affects the function am65_cpsw_ndo_xdp_xmit of the file /xdp-trafficgen of the component Virtual Address Handler. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: Fix NULL dereference on XDP_TX If number of TX queues are set to 1 we get a NULL pointer dereference during XDP_TX. ~# ethtool -L eth0 tx 1 ~# ./xdp-trafficgen udp -A -a eth0 -t 2 Transmitting on eth0 (ifindex 2) [ 241.135257] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030 Fix this by using actual TX queues instead of max TX queues when picking the TX channel in am65_cpsw_ndo_xdp_xmit().

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2024-46799 since 09/11/2024. Technical details and also a exploit are known.

It is declared as proof-of-concept.

Upgrading to version 6.10.10 eliminates this vulnerability. Applying the patch 2e7189d2b1de/0a50c35277f9 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2024-2173). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• Google Cloud Platform
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• IBM InfoSphere Guardium
• Oracle Linux
• RESF Rocky Linux
• Open Source Linux Kernel
• SolarWinds Security Event Manager

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.10.0
• 6.10.1
• 6.10.2
• 6.10.3
• 6.10.4
• 6.10.5
• 6.10.6
• 6.10.7
• 6.10.8
• 6.10.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion