CVE-2024-58099 (GCVE-0-2024-58099)

Vulnerability from cvelistv5 – Published: 2025-04-29 11:45 – Updated: 2026-08-05 11:47
VLAI
Title
vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame
Summary
In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame Andrew and Nikolay reported connectivity issues with Cilium's service load-balancing in case of vmxnet3. If a BPF program for native XDP adds an encapsulation header such as IPIP and transmits the packet out the same interface, then in case of vmxnet3 a corrupted packet is being sent and subsequently dropped on the path. vmxnet3_xdp_xmit_frame() which is called e.g. via vmxnet3_run_xdp() through vmxnet3_xdp_xmit_back() calculates an incorrect DMA address: page = virt_to_page(xdpf->data); tbi->dma_addr = page_pool_get_dma_addr(page) + VMXNET3_XDP_HEADROOM; dma_sync_single_for_device(&adapter->pdev->dev, tbi->dma_addr, buf_size, DMA_TO_DEVICE); The above assumes a fixed offset (VMXNET3_XDP_HEADROOM), but the XDP BPF program could have moved xdp->data. While the passed buf_size is correct (xdpf->len), the dma_addr needs to have a dynamic offset which can be calculated as xdpf->data - (void *)xdpf, that is, xdp->data - xdp->data_hard_start.
Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 54f00cce11786742bd11e5e68c3bf85e6dc048c9 , < 59ba6cdadb9c26b606a365eb9c9b25eb2052622d (git)
Affected: 54f00cce11786742bd11e5e68c3bf85e6dc048c9 , < f82eb34fb59a8fb96c19f4f492c20eb774140bb5 (git)
Affected: 54f00cce11786742bd11e5e68c3bf85e6dc048c9 , < 4678adf94da4a9e9683817b246b58ce15fb81782 (git)
Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.59 , ≤ 6.6.* (semver)
Unaffected: 6.11.6 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-58099",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T16:12:22.218510Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T16:12:26.226Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vmxnet3/vmxnet3_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "59ba6cdadb9c26b606a365eb9c9b25eb2052622d",
              "status": "affected",
              "version": "54f00cce11786742bd11e5e68c3bf85e6dc048c9",
              "versionType": "git"
            },
            {
              "lessThan": "f82eb34fb59a8fb96c19f4f492c20eb774140bb5",
              "status": "affected",
              "version": "54f00cce11786742bd11e5e68c3bf85e6dc048c9",
              "versionType": "git"
            },
            {
              "lessThan": "4678adf94da4a9e9683817b246b58ce15fb81782",
              "status": "affected",
              "version": "54f00cce11786742bd11e5e68c3bf85e6dc048c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vmxnet3/vmxnet3_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.59",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame\n\nAndrew and Nikolay reported connectivity issues with Cilium\u0027s service\nload-balancing in case of vmxnet3.\n\nIf a BPF program for native XDP adds an encapsulation header such as\nIPIP and transmits the packet out the same interface, then in case\nof vmxnet3 a corrupted packet is being sent and subsequently dropped\non the path.\n\nvmxnet3_xdp_xmit_frame() which is called e.g. via vmxnet3_run_xdp()\nthrough vmxnet3_xdp_xmit_back() calculates an incorrect DMA address:\n\n  page = virt_to_page(xdpf-\u003edata);\n  tbi-\u003edma_addr = page_pool_get_dma_addr(page) +\n                  VMXNET3_XDP_HEADROOM;\n  dma_sync_single_for_device(\u0026adapter-\u003epdev-\u003edev,\n                             tbi-\u003edma_addr, buf_size,\n                             DMA_TO_DEVICE);\n\nThe above assumes a fixed offset (VMXNET3_XDP_HEADROOM), but the XDP\nBPF program could have moved xdp-\u003edata. While the passed buf_size is\ncorrect (xdpf-\u003elen), the dma_addr needs to have a dynamic offset which\ncan be calculated as xdpf-\u003edata - (void *)xdpf, that is, xdp-\u003edata -\nxdp-\u003edata_hard_start."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is reached purely by receiving a network packet on a vmxnet3 interface that a native XDP program encapsulates and returns XDP_TX for; no local access is needed and the corrupted/leaky frame is emitted onto the network.\nAC:L - On a target running a native XDP program that adjusts the head and XDP_TXes (a standard Cilium-on-VMware deployment), every such packet deterministically hits the wrong DMA offset \u2014 there is no race, no memory-layout dependency, and no condition the attacker must win.\nPR:N - A remote, unauthenticated attacker only has to send packets to the interface; the XDP program attachment is normal operator configuration, not something the attacker must obtain privileges for.\nUI:N - No victim action is required \u2014 the bug fires automatically during NAPI receive processing of an attacker-supplied packet.\nS:U - The mis-computed DMA address stays within the same page-pool page owned by the driver, so the impact remains within the kernel\u0027s own security authority with no VM/IOMMU boundary crossing.\nC:H - Each transmitted frame appends up to ~216 bytes of page content beyond the received packet \u2014 remnants of other flows received on the same NIC or non-zeroed pages freshly taken from the buddy allocator \u2014 and an attacker can drive this at packet rate to harvest a large aggregate of kernel memory onto the wire.\nI:L - The frame placed on the wire is not what the BPF program constructed (the encap/rewritten header is dropped and attacker-controlled bytes land in header positions), which can defeat an XDP-based encapsulation or sanitization policy, but no kernel memory is written and there is no arbitrary-write primitive.\nA:L - The corrupted frames are dropped on the path, breaking connectivity for the affected XDP-forwarded traffic, but the DMA window provably stays inside the mapped page so there is no oops, hang, or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:44.871Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/59ba6cdadb9c26b606a365eb9c9b25eb2052622d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f82eb34fb59a8fb96c19f4f492c20eb774140bb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4678adf94da4a9e9683817b246b58ce15fb81782"
        }
      ],
      "title": "vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58099",
    "datePublished": "2025-04-29T11:45:30.997Z",
    "dateReserved": "2025-03-06T15:52:09.189Z",
    "dateUpdated": "2026-08-05T11:47:44.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-58099",
      "date": "2026-08-05",
      "epss": "0.00306",
      "percentile": "0.22887"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-58099\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-29T12:15:31.053\",\"lastModified\":\"2026-08-04T11:22:39.857\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame\\n\\nAndrew and Nikolay reported connectivity issues with Cilium\u0027s service\\nload-balancing in case of vmxnet3.\\n\\nIf a BPF program for native XDP adds an encapsulation header such as\\nIPIP and transmits the packet out the same interface, then in case\\nof vmxnet3 a corrupted packet is being sent and subsequently dropped\\non the path.\\n\\nvmxnet3_xdp_xmit_frame() which is called e.g. via vmxnet3_run_xdp()\\nthrough vmxnet3_xdp_xmit_back() calculates an incorrect DMA address:\\n\\n  page = virt_to_page(xdpf-\u003edata);\\n  tbi-\u003edma_addr = page_pool_get_dma_addr(page) +\\n                  VMXNET3_XDP_HEADROOM;\\n  dma_sync_single_for_device(\u0026adapter-\u003epdev-\u003edev,\\n                             tbi-\u003edma_addr, buf_size,\\n                             DMA_TO_DEVICE);\\n\\nThe above assumes a fixed offset (VMXNET3_XDP_HEADROOM), but the XDP\\nBPF program could have moved xdp-\u003edata. While the passed buf_size is\\ncorrect (xdpf-\u003elen), the dma_addr needs to have a dynamic offset which\\ncan be calculated as xdpf-\u003edata - (void *)xdpf, that is, xdp-\u003edata -\\nxdp-\u003edata_hard_start.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vmxnet3: Se corrige la corrupci\u00f3n de paquetes en vmxnet3_xdp_xmit_frame. Andrew y Nikolay informaron sobre problemas de conectividad con el balanceo de carga del servicio de Cilium en el caso de vmxnet3. Si un programa BPF para XDP nativo a\u00f1ade un encabezado de encapsulaci\u00f3n como IPIP y transmite el paquete por la misma interfaz, en el caso de vmxnet3 se env\u00eda un paquete da\u00f1ado que posteriormente se descarta en la ruta. vmxnet3_xdp_xmit_frame(), que se llama, por ejemplo, mediante vmxnet3_run_xdp() a trav\u00e9s de vmxnet3_xdp_xmit_back(), calcula una direcci\u00f3n DMA incorrecta: page = virt_to_page(xdpf-\u0026gt;data); tbi-\u0026gt;dma_addr = page_pool_get_dma_addr(page) + VMXNET3_XDP_HEADROOM; dma_sync_single_for_device(\u0026amp;adapter-\u0026gt;pdev-\u0026gt;dev, tbi-\u0026gt;dma_addr, buf_size, DMA_TO_DEVICE); Lo anterior asume un desplazamiento fijo (VMXNET3_XDP_HEADROOM), pero el programa XDP BPF podr\u00eda haber movido xdp-\u0026gt;data. Si bien el buf_size pasado es correcto (xdpf-\u0026gt;len), dma_addr debe tener un desplazamiento din\u00e1mico que se puede calcular como xdpf-\u0026gt;data - (void *)xdpf, es decir, xdp-\u0026gt;data - xdp-\u0026gt;data_hard_start.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/vmxnet3/vmxnet3_xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"54f00cce11786742bd11e5e68c3bf85e6dc048c9\",\"lessThan\":\"59ba6cdadb9c26b606a365eb9c9b25eb2052622d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54f00cce11786742bd11e5e68c3bf85e6dc048c9\",\"lessThan\":\"f82eb34fb59a8fb96c19f4f492c20eb774140bb5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54f00cce11786742bd11e5e68c3bf85e6dc048c9\",\"lessThan\":\"4678adf94da4a9e9683817b246b58ce15fb81782\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/vmxnet3/vmxnet3_xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.59\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.6\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T16:12:22.218510Z\",\"id\":\"CVE-2024-58099\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.59\",\"matchCriteriaId\":\"7DD6A680-9CD9-4AC0-B481-31440B98FFD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.6\",\"matchCriteriaId\":\"E4486B12-007B-4794-9857-F07145637AA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4678adf94da4a9e9683817b246b58ce15fb81782\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/59ba6cdadb9c26b606a365eb9c9b25eb2052622d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f82eb34fb59a8fb96c19f4f492c20eb774140bb5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:08:06+00:00",
      "cve": "CVE-2024-58099",
      "id": "CVE-2024-58099",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:fixed": "584",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-58099.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:11:29Z",
      "cve": "CVE-2024-58099",
      "id": "CVE-2024-58099",
      "initial_release_date": "2025-04-30T03:18:40Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "294",
      "product_status:recommended": "397",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-58099",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-58099.json",
      "version": "40"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-58099\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T16:12:22.218510Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T14:34:27.126Z\"}}], \"cna\": {\"title\": \"vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.6, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"54f00cce11786742bd11e5e68c3bf85e6dc048c9\", \"lessThan\": \"59ba6cdadb9c26b606a365eb9c9b25eb2052622d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"54f00cce11786742bd11e5e68c3bf85e6dc048c9\", \"lessThan\": \"f82eb34fb59a8fb96c19f4f492c20eb774140bb5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"54f00cce11786742bd11e5e68c3bf85e6dc048c9\", \"lessThan\": \"4678adf94da4a9e9683817b246b58ce15fb81782\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/vmxnet3/vmxnet3_xdp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.59\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/vmxnet3/vmxnet3_xdp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/59ba6cdadb9c26b606a365eb9c9b25eb2052622d\"}, {\"url\": \"https://git.kernel.org/stable/c/f82eb34fb59a8fb96c19f4f492c20eb774140bb5\"}, {\"url\": \"https://git.kernel.org/stable/c/4678adf94da4a9e9683817b246b58ce15fb81782\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame\\n\\nAndrew and Nikolay reported connectivity issues with Cilium\u0027s service\\nload-balancing in case of vmxnet3.\\n\\nIf a BPF program for native XDP adds an encapsulation header such as\\nIPIP and transmits the packet out the same interface, then in case\\nof vmxnet3 a corrupted packet is being sent and subsequently dropped\\non the path.\\n\\nvmxnet3_xdp_xmit_frame() which is called e.g. via vmxnet3_run_xdp()\\nthrough vmxnet3_xdp_xmit_back() calculates an incorrect DMA address:\\n\\n  page = virt_to_page(xdpf-\u003edata);\\n  tbi-\u003edma_addr = page_pool_get_dma_addr(page) +\\n                  VMXNET3_XDP_HEADROOM;\\n  dma_sync_single_for_device(\u0026adapter-\u003epdev-\u003edev,\\n                             tbi-\u003edma_addr, buf_size,\\n                             DMA_TO_DEVICE);\\n\\nThe above assumes a fixed offset (VMXNET3_XDP_HEADROOM), but the XDP\\nBPF program could have moved xdp-\u003edata. While the passed buf_size is\\ncorrect (xdpf-\u003elen), the dma_addr needs to have a dynamic offset which\\ncan be calculated as xdpf-\u003edata - (void *)xdpf, that is, xdp-\u003edata -\\nxdp-\u003edata_hard_start.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.59\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.6\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-04T09:42:46.535Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-58099\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-04T09:42:46.535Z\", \"dateReserved\": \"2025-03-06T15:52:09.189Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-04-29T11:45:30.997Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.