PT-2024-32780 · Linux+5 · Linux Kernel+5
Syzbot
·
Published
2024-09-18
·
Updated
2025-09-29
·
CVE-2024-47734
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.58
Description
A vulnerability in the Linux kernel has been resolved, specifically in the bonding module. The issue was reported by syzbot and involved unnecessary warnings and logs from the
bond xdp get xmit slave() function. This occurred when one bond device had xdpdrv and another bond device, unsupported by XDP, had a slave with xdpgeneric that returned XDP TX. To address this, the WARN ON ONCE() was deleted and a ratelimit was added to the netdev err(). The vulnerability can be reproduced by creating specific bond devices and configuring them with xdpdrv and xdpgeneric.Recommendations
To resolve the issue, update to Linux kernel version 6.6.58 or later. As a temporary workaround, consider disabling the
bond xdp get xmit slave() function until a patch is available. Restrict access to the vulnerable bonding module to minimize the risk of exploitation. Avoid using the xdpdrv and xdpgeneric objects in the affected bond devices until the issue is resolved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Ubuntu