Linux Kernel RDMA/rxe Vulnerability: Slab Use-After-Free Issue
Summary
CVE-2024-57795: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Remove the direct link to net_device The similar patch in siw is in the link: https://git.kernel.org/rdma/rdma/c/16b87037b48889 This problem a... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of functionalities, including networking, file systems, and device management. The RDMA (Remote Direct Memory Access) subsystem allows for high-throughput, low-latency networking, which is crucial for performance-sensitive applications. However, a vulnerability has been identified in the RDMA/rxe implementation, which can lead to serious security issues if not addressed.
Vulnerability Detail
The vulnerability, identified as CVE-2024-57795, arises from a slab-use-after-free condition in the RDMA/rxe component of the Linux kernel. This issue occurs when a network device is freed while still being referenced by an ongoing operation, leading to potential memory corruption and unauthorized access to sensitive data. The vulnerability was triggered by the ib_cache_event_task, which attempted to access a freed net device, resulting in a crash and possible exploitation by an attacker.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the RDMA/rxe functionality if it is not essential for their operations. This can be done by removing or blacklisting the rxe module from the kernel. To blacklist the module, add 'blacklist rxe' to the '/etc/modprobe.d/blacklist.conf' file and then run 'sudo update-initramfs -u'.
Conclusion
CVE-2024-57795 is a critical vulnerability in the Linux kernel's RDMA/rxe implementation that can lead to severe security risks. Users are advised to update their systems promptly to mitigate these risks and ensure the integrity of their systems.
See every vulnerability recorded for linux →
FAQ
CVE-2024-57795 is a vulnerability in the Linux kernel's RDMA/rxe component that can lead to a slab-use-after-free condition, potentially allowing attackers to exploit memory corruption.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
The risks include potential memory corruption, system crashes, and unauthorized access to sensitive data, which can lead to further exploitation by attackers.
Yes, a patch is available. Users should update their Linux kernel to the latest version that includes the fix for CVE-2024-57795.
If immediate updates are not possible, consider disabling the RDMA/rxe functionality as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
