Critical Vulnerability in Linux Kernel: sfc Driver Crash Due to Improper xdp_do_flush Invocation
Summary
DEBIAN-CVE-2024-50094: In the Linux kernel, the following vulnerability has been resolved: sfc: Don't invoke xdp_do_flush() from netpoll. Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and flexibility, supporting a wide range of hardware architectures. The kernel includes various drivers, including the sfc driver, which facilitates communication between the operating system and network hardware. This vulnerability arises from a flaw in the netpoll mechanism, which can lead to system crashes under specific conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the sfc driver related to the netpoll feature. When netpoll sends a message, it invokes the driver's NAPI function with a budget of zero, which is intended to allow the driver to free transmission resources. However, this leads to an unconditional call to xdp_do_flush(), which causes a crash because the required bpf_net_context was never assigned. This flaw can result in system instability and crashes, particularly affecting systems using the sfc driver under netpoll conditions.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The vulnerability in the Linux kernel's sfc driver poses a significant risk of system crashes under specific conditions. Users are strongly advised to update their systems to the patched version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a flaw in the sfc driver that can cause system crashes when the netpoll feature is used.
It can lead to instability and crashes, particularly when using the sfc driver in conjunction with netpoll.
Yes, a patch is available in the form of an updated package version (6.11.4-1) for Debian systems.
While there are no specific workarounds, it is recommended to monitor the situation and apply the patch as soon as possible.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application at Vulert Scanner without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
