CVE-2024-35889 (GCVE-0-2024-35889)

Vulnerability from cvelistv5 – Published: 2024-05-19 08:34 – Updated: 2026-08-05 11:30
VLAI
Title
idpf: fix kernel panic on unknown packet types
Summary
In the Linux kernel, the following vulnerability has been resolved: idpf: fix kernel panic on unknown packet types In the very rare case where a packet type is unknown to the driver, idpf_rx_process_skb_fields would return early without calling eth_type_trans to set the skb protocol / the network layer handler. This is especially problematic if tcpdump is running when such a packet is received, i.e. it would cause a kernel panic. Instead, call eth_type_trans for every single packet, even when the packet type is unknown.
Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 3a8845af66edb340ba9210bb8a0da040c7d6e590 , < b4d28f7fa4dd531cf503a4fe1ca7008960cc5832 (git)
Affected: 3a8845af66edb340ba9210bb8a0da040c7d6e590 , < dd19e827d63ac60debf117676d1126bff884bdb8 (git)
Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.8.5 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35889",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T19:38:07.128474Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:34:30.127Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.615Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b4d28f7fa4dd531cf503a4fe1ca7008960cc5832"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dd19e827d63ac60debf117676d1126bff884bdb8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b4d28f7fa4dd531cf503a4fe1ca7008960cc5832",
              "status": "affected",
              "version": "3a8845af66edb340ba9210bb8a0da040c7d6e590",
              "versionType": "git"
            },
            {
              "lessThan": "dd19e827d63ac60debf117676d1126bff884bdb8",
              "status": "affected",
              "version": "3a8845af66edb340ba9210bb8a0da040c7d6e590",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix kernel panic on unknown packet types\n\nIn the very rare case where a packet type is unknown to the driver,\nidpf_rx_process_skb_fields would return early without calling\neth_type_trans to set the skb protocol / the network layer handler.\nThis is especially problematic if tcpdump is running when such a\npacket is received, i.e. it would cause a kernel panic.\n\nInstead, call eth_type_trans for every single packet, even when\nthe packet type is unknown."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached purely by processing a received Ethernet frame in the idpf splitq NAPI RX path, before any protocol demux, socket lookup, or firewall, so any remote party able to get a packet to the interface triggers it. Frames that the E2100/IPU parser leaves unclassified include routable traffic (unusual IP protocol numbers, exotic IPv6 extension-header chains, unsupported nested tunnels), so reachability is not limited to the local L2 segment.\nAC:L - The attacker fully controls the only variable that matters \u2014 the packet\u0027s protocol layout \u2014 and can sweep encapsulations until the NIC returns a ptype absent from the driver\u0027s lookup table; no race, no memory grooming, no timing window. The consumers that turn the malformed skb into a panic or an OOB read (AF_PACKET/tcpdump taps, bridge/OVS rx_handler, GRO header comparison) are ubiquitous on the cloud-host and cloud-VM systems where idpf is deployed, and the GRO path needs no extra configuration at all.\nPR:N - No credentials, authentication, or local account are required; the panic occurs in idpf\u0027s softirq RX path before any protocol demux, so the frame need not even be addressed to a listening service. Any unauthenticated sender on the network suffices.\nUI:N - Triggering requires only that the victim\u0027s idpf interface be up and receiving; the fault happens in softirq context during ordinary packet reception. No local user or administrator has to open, mount, or click anything.\nS:U - The vulnerable driver code and the impacted resource are both the same kernel \u2014 a standard in-kernel crash and in-kernel OOB read with no crossing of a VM, IOMMU, or sandbox security authority.\nC:L - Because mac_header is left at the 0xFFFF \"unset\" sentinel, consumers dereference skb-\u003ehead + 65535: gro_list_prepare()\u0027s compare_ether_header() reads 14 bytes of unrelated kernel memory out of bounds on the normal GRO path, and br_handle_frame() reads eth_hdr()-\u003eh_source from the same address, with those out-of-bounds bytes then learned into the bridge FDB where any local user can read them back via netlink. The disclosure is real but bounded to a fixed 14-byte window rather than an arbitrary read.\nI:L - Out-of-bounds bytes are written into kernel forwarding state (bridge FDB entries learned from head+65535), and the skb is propagated with corrupted metadata \u2014 protocol 0, wrapped mac_len, un-stripped Ethernet header \u2014 which misdirects downstream forwarding and header parsing. There is no arbitrary-write primitive: skb_push()\u0027s underflow is caught by the skb_under_panic() bounds check before any memory is written, so the impact is limited rather than High.\nA:H - packet_rcv()/tpacket_rcv() computes a ~4-billion-byte skb_push() length from the unset mac_header, driving skb-\u003edata below skb-\u003ehead and hitting skb_under_panic() \u2192 BUG() from NAPI/softirq context \u2014 a fatal exception in interrupt and a full kernel panic. A single crafted frame takes the machine down and can be replayed at will against every affected host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:43.420Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b4d28f7fa4dd531cf503a4fe1ca7008960cc5832"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd19e827d63ac60debf117676d1126bff884bdb8"
        }
      ],
      "title": "idpf: fix kernel panic on unknown packet types",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35889",
    "datePublished": "2024-05-19T08:34:45.274Z",
    "dateReserved": "2024-05-17T13:50:33.113Z",
    "dateUpdated": "2026-08-05T11:30:43.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35889",
      "date": "2026-08-09",
      "epss": "0.0038",
      "percentile": "0.30811"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.8.5\", \"matchCriteriaId\": \"DBD6C99E-4250-4DFE-8447-FF2075939D10\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nidpf: fix kernel panic on unknown packet types\\n\\nIn the very rare case where a packet type is unknown to the driver,\\nidpf_rx_process_skb_fields would return early without calling\\neth_type_trans to set the skb protocol / the network layer handler.\\nThis is especially problematic if tcpdump is running when such a\\npacket is received, i.e. it would cause a kernel panic.\\n\\nInstead, call eth_type_trans for every single packet, even when\\nthe packet type is unknown.\"}, {\"lang\": \"es\", \"value\": \" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: idpf: corrige el p\\u00e1nico del kernel en tipos de paquetes desconocidos. En el caso muy raro de que el controlador desconozca un tipo de paquete, idpf_rx_process_skb_fields regresar\\u00eda antes de tiempo sin llamar a eth_type_trans para configurar el protocolo skb/el manejador de capa de red. Esto es especialmente problem\\u00e1tico si tcpdump se est\\u00e1 ejecutando cuando se recibe dicho paquete, es decir, causar\\u00eda un p\\u00e1nico en el kernel. En su lugar, llame a eth_type_trans para cada paquete, incluso cuando se desconozca el tipo de paquete.\"}]",
      "id": "CVE-2024-35889",
      "lastModified": "2024-12-31T18:50:40.020",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-19T09:15:09.997",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/b4d28f7fa4dd531cf503a4fe1ca7008960cc5832\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dd19e827d63ac60debf117676d1126bff884bdb8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b4d28f7fa4dd531cf503a4fe1ca7008960cc5832\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dd19e827d63ac60debf117676d1126bff884bdb8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35889\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-19T09:15:09.997\",\"lastModified\":\"2026-08-04T11:18:06.680\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nidpf: fix kernel panic on unknown packet types\\n\\nIn the very rare case where a packet type is unknown to the driver,\\nidpf_rx_process_skb_fields would return early without calling\\neth_type_trans to set the skb protocol / the network layer handler.\\nThis is especially problematic if tcpdump is running when such a\\npacket is received, i.e. it would cause a kernel panic.\\n\\nInstead, call eth_type_trans for every single packet, even when\\nthe packet type is unknown.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: idpf: corrige el p\u00e1nico del kernel en tipos de paquetes desconocidos. En el caso muy raro de que el controlador desconozca un tipo de paquete, idpf_rx_process_skb_fields regresar\u00eda antes de tiempo sin llamar a eth_type_trans para configurar el protocolo skb/el manejador de capa de red. Esto es especialmente problem\u00e1tico si tcpdump se est\u00e1 ejecutando cuando se recibe dicho paquete, es decir, causar\u00eda un p\u00e1nico en el kernel. En su lugar, llame a eth_type_trans para cada paquete, incluso cuando se desconozca el tipo de paquete.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/intel/idpf/idpf_txrx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3a8845af66edb340ba9210bb8a0da040c7d6e590\",\"lessThan\":\"b4d28f7fa4dd531cf503a4fe1ca7008960cc5832\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3a8845af66edb340ba9210bb8a0da040c7d6e590\",\"lessThan\":\"dd19e827d63ac60debf117676d1126bff884bdb8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/intel/idpf/idpf_txrx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.5\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-23T19:38:07.128474Z\",\"id\":\"CVE-2024-35889\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.5\",\"matchCriteriaId\":\"DBD6C99E-4250-4DFE-8447-FF2075939D10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b4d28f7fa4dd531cf503a4fe1ca7008960cc5832\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dd19e827d63ac60debf117676d1126bff884bdb8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b4d28f7fa4dd531cf503a4fe1ca7008960cc5832\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dd19e827d63ac60debf117676d1126bff884bdb8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:58:32+00:00",
      "cve": "CVE-2024-35889",
      "id": "CVE-2024-35889",
      "initial_release_date": "2024-05-19T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: idpf: fix kernel panic on unknown packet types",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35889.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:58:42Z",
      "cve": "CVE-2024-35889",
      "id": "CVE-2024-35889",
      "initial_release_date": "2024-05-21T01:59:29Z",
      "product_status:known_affected": "330",
      "product_status:known_not_affected": "181",
      "product_status:recommended": "660",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35889",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35889.json",
      "version": "106"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b4d28f7fa4dd531cf503a4fe1ca7008960cc5832\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/dd19e827d63ac60debf117676d1126bff884bdb8\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:48.615Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35889\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-23T19:38:07.128474Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:38:11.006Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"idpf: fix kernel panic on unknown packet types\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.6, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The bug is reached purely by processing a received Ethernet frame in the idpf splitq NAPI RX path, before any protocol demux, socket lookup, or firewall, so any remote party able to get a packet to the interface triggers it. Frames that the E2100/IPU parser leaves unclassified include routable traffic (unusual IP protocol numbers, exotic IPv6 extension-header chains, unsupported nested tunnels), so reachability is not limited to the local L2 segment.\\nAC:L - The attacker fully controls the only variable that matters \\u2014 the packet\u0027s protocol layout \\u2014 and can sweep encapsulations until the NIC returns a ptype absent from the driver\u0027s lookup table; no race, no memory grooming, no timing window. The consumers that turn the malformed skb into a panic or an OOB read (AF_PACKET/tcpdump taps, bridge/OVS rx_handler, GRO header comparison) are ubiquitous on the cloud-host and cloud-VM systems where idpf is deployed, and the GRO path needs no extra configuration at all.\\nPR:N - No credentials, authentication, or local account are required; the panic occurs in idpf\u0027s softirq RX path before any protocol demux, so the frame need not even be addressed to a listening service. Any unauthenticated sender on the network suffices.\\nUI:N - Triggering requires only that the victim\u0027s idpf interface be up and receiving; the fault happens in softirq context during ordinary packet reception. No local user or administrator has to open, mount, or click anything.\\nS:U - The vulnerable driver code and the impacted resource are both the same kernel \\u2014 a standard in-kernel crash and in-kernel OOB read with no crossing of a VM, IOMMU, or sandbox security authority.\\nC:L - Because mac_header is left at the 0xFFFF \\\"unset\\\" sentinel, consumers dereference skb-\u003ehead + 65535: gro_list_prepare()\u0027s compare_ether_header() reads 14 bytes of unrelated kernel memory out of bounds on the normal GRO path, and br_handle_frame() reads eth_hdr()-\u003eh_source from the same address, with those out-of-bounds bytes then learned into the bridge FDB where any local user can read them back via netlink. The disclosure is real but bounded to a fixed 14-byte window rather than an arbitrary read.\\nI:L - Out-of-bounds bytes are written into kernel forwarding state (bridge FDB entries learned from head+65535), and the skb is propagated with corrupted metadata \\u2014 protocol 0, wrapped mac_len, un-stripped Ethernet header \\u2014 which misdirects downstream forwarding and header parsing. There is no arbitrary-write primitive: skb_push()\u0027s underflow is caught by the skb_under_panic() bounds check before any memory is written, so the impact is limited rather than High.\\nA:H - packet_rcv()/tpacket_rcv() computes a ~4-billion-byte skb_push() length from the unset mac_header, driving skb-\u003edata below skb-\u003ehead and hitting skb_under_panic() \\u2192 BUG() from NAPI/softirq context \\u2014 a fatal exception in interrupt and a full kernel panic. A single crafted frame takes the machine down and can be replayed at will against every affected host.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3a8845af66edb340ba9210bb8a0da040c7d6e590\", \"lessThan\": \"b4d28f7fa4dd531cf503a4fe1ca7008960cc5832\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3a8845af66edb340ba9210bb8a0da040c7d6e590\", \"lessThan\": \"dd19e827d63ac60debf117676d1126bff884bdb8\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/intel/idpf/idpf_txrx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/idpf/idpf_txrx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b4d28f7fa4dd531cf503a4fe1ca7008960cc5832\"}, {\"url\": \"https://git.kernel.org/stable/c/dd19e827d63ac60debf117676d1126bff884bdb8\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nidpf: fix kernel panic on unknown packet types\\n\\nIn the very rare case where a packet type is unknown to the driver,\\nidpf_rx_process_skb_fields would return early without calling\\neth_type_trans to set the skb protocol / the network layer handler.\\nThis is especially problematic if tcpdump is running when such a\\npacket is received, i.e. it would cause a kernel panic.\\n\\nInstead, call eth_type_trans for every single packet, even when\\nthe packet type is unknown.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.5\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:43.420Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35889\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:43.420Z\", \"dateReserved\": \"2024-05-17T13:50:33.113Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-19T08:34:45.274Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.