PT-2024-26820 · Linux+5 · Linux Kernel+5
Breno Leitao
·
Published
2024-04-03
·
Updated
2025-02-03
·
CVE-2024-35981
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
There is a bug in the Linux kernel when setting the RSS options in virtio net that can break the whole machine, getting the kernel into an infinite loop. This issue can be reproduced by running the command
# ethtool -X eth0 hfunc toeplitz in any QEMU virtual machine with virtionet. The problem occurs because the virtnet commit rss command() function populates 4 entries for the rss scatter-gather, and since the command above does not have a key, the last scatter-gather entry will be zeroed. This buffer is then passed to qemu, which is not happy with a buffer with zero length, resulting in an error. The kernel is waiting for the response to come back, but qemu has bailed out, causing the kernel to loop forever.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu