Packet Corruption Vulnerability in Linux Kernel's vmxnet3 Package
Summary
DEBIAN-CVE-2024-58099: In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame Andrew and Nikolay reported connectivity issues with Cilium's service load-balancing in case of... Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. The vmxnet3 driver is a high-performance virtual network interface designed for VMware environments, enabling efficient data transmission. However, it has been identified that this driver is susceptible to a vulnerability that can lead to packet corruption during transmission, particularly when using BPF programs for encapsulation.
Vulnerability Detail
The vulnerability arises from an incorrect calculation of the DMA address in the vmxnet3_xdp_xmit_frame function. When a BPF program adds an encapsulation header (e.g., IPIP) and transmits the packet, the driver may send a corrupted packet due to a fixed offset assumption. This can lead to connectivity issues, particularly affecting services like Cilium's load-balancing. The technical flaw lies in the assumption that the offset is static, while it should be dynamic based on the actual data position.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling the use of BPF programs that add encapsulation headers until the package is updated. This can help mitigate the risk of packet corruption during transmission.
Conclusion
The identified vulnerability in the vmxnet3 driver of the Linux kernel poses significant risks related to packet corruption during data transmission. It is crucial for users to update their systems to the latest patched version to mitigate these risks effectively. Additionally, utilizing tools like Vulert can help in monitoring vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves packet corruption in the vmxnet3 driver when using BPF programs that add encapsulation headers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability may lead to connectivity issues and data loss in applications relying on the vmxnet3 driver.
Yes, you should upgrade to version 6.11.6-1 or later of the Linux package.
Yes, Vulert provides a simple way to monitor and alert for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
