In the Linux kernel, the following vulnerability has been resolved:
igc: avoid returning frame twice in XDP_REDIRECT
When a frame can not be transmitted in XDP_REDIRECT (e.g. due to a full queue), it is necessary to free it by calling xdp_return_frame_rx_napi.
However, this is the responsibility of the caller of the ndo_xdp_xmit (see for example bq_xmit_all in kernel/bpf/devmap.c) and thus calling it inside igc_xdp_xmit (which is the ndo_xdp_xmit of the igc driver) as well will lead to memory corruption.
In fact, bq_xmit_all expects that it can return all frames after the last successfully transmitted one. Therefore, break for the first not transmitted frame, but do not call xdp_return_frame_rx_napi in igc_xdp_xmit. This is equally implemented in other Intel drivers such as the igb.
There are two alternatives to this that were rejected: 1. Return num_frames as all the frames would have been transmitted and release them inside igc_xdp_xmit. While it might work technically, it is not what the return value is meant to represent (i.e. the number of SUCCESSFULLY transmitted packets). 2. Rework kernel/bpf/devmap.c and all drivers to support non-consecutively dropped packets. Besides being complex, it likely has a negative performance impact without a significant gain since it is anyway unlikely that the next frame can be transmitted if the previous one was dropped.
The memory corruption can be reproduced with the following script which leads to a kernel panic after a few seconds. It basically generates more traffic than a i225 NIC can transmit and pushes it via XDP_REDIRECT from a virtual interface to the physical interface where frames get dropped.
#!/bin/bash INTERFACE=enp4s0 INTERFACE_IDX=`cat /sys/class/net/$INTERFACE/ifindex`
sudo ip link add dev veth1 type veth peer name veth2 sudo ip link set up $INTERFACE sudo ip link set up veth1 sudo ip link set up veth2
cat << EOF > redirect.bpf.c
SEC("prog") int redirect(struct xdp_md *ctx) { return bpf_redirect($INTERFACE_IDX, 0); }
char _license[] SEC("license") = "GPL"; EOF clang -O2 -g -Wall -target bpf -c redirect.bpf.c -o redirect.bpf.o sudo ip link set veth2 xdp obj redirect.bpf.o
cat << EOF > pass.bpf.c
SEC("prog") int pass(struct xdp_md *ctx) { return XDP_PASS; }
char _license[] SEC("license") = "GPL"; EOF clang -O2 -g -Wall -target bpf -c pass.bpf.c -o pass.bpf.o sudo ip link set $INTERFACE xdp obj pass.bpf.o
cat << EOF > trafgen.cfg
{ /* Ethernet Header */ 0xe8, 0x6a, 0x64, 0x41, 0xbf, 0x46, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, const16(ETH_P_IP),
/* IPv4 Header */ 0b01000101, 0, # IPv4 version, IHL, TOS const16(1028), # IPv4 total length (UDP length + 20 bytes (IP header)) const16(2), # IPv4 ident 0b01000000, 0, # IPv4 flags, fragmentation off 64, # IPv4 TTL 17, # Protocol UDP csumip(14, 33), # IPv4 checksum
/* UDP Header */ 10, 0, 1, 1, # IP Src - adapt as needed 10, 0, 1, 2, # IP Dest - adapt as needed const16(6666), # UDP Src Port const16(6666), # UDP Dest Port const16(1008), # UDP length (UDP header 8 bytes + payload length) csumudp(14, 34), # UDP checksum
/* Payload */ fill('W', 1000), } EOF
sudo trafgen -i trafgen.cfg -b3000MB -o veth1 --cpp
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rvUpgrade kernel-64k-debugUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-debug-coreUpgrade kernel-64k-coreUpgrade rtlaUpgrade kernel-rtUpgrade kernel-zfcpdumpUpgrade kernel-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-64k-develUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-headersUpgrade kernel-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-modules-extraUpgrade kernel-tools-libsUpgrade kernel-uki-virtUpgrade kernel-coreUpgrade kernel-debugUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-kvmUpgrade bpftoolUpgrade kernel-rt-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-rt-develUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-toolsUpgrade kernel-64k-debug-modulesUpgrade kernel-debug-develUpgrade kernel-rt-debug-develUpgrade kernel-docUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debugUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-devel-matchedUpgrade kernel-cross-headersUpgrade kernel-64kUpgrade kernel-64k-debug-coreUpgrade perfUpgrade kernel-64k-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-develUpgrade kernel-tools-libs-develUpgrade kernel-devel-matchedUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-modulesUpgrade python3-perfUpgrade kernel-rt-coreUpgrade libperfUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-modules-extra | Aug 12, 2024 | Apr 17, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 17, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | Apr 17, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Aug 12, 2024 | Apr 17, 2024 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-devel-matchedUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-coreUpgrade libperf-debuginfoUpgrade kernel-tools-libsUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-cross-headersUpgrade kernelUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-develUpgrade bpftoolUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-coreUpgrade kernel-tools-libs-develUpgrade python3-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rtUpgrade kernel-debuginfoUpgrade kernel-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-debuginfoUpgrade perf-debuginfoUpgrade kernel-uki-virtUpgrade perfUpgrade kernel-modulesUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-modules-coreUpgrade libperfUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-coreUpgrade rvUpgrade kernel-zfcpdump-modulesUpgrade kernel-toolsUpgrade kernel-rt-modulesUpgrade rtlaUpgrade kernel-rt-debug-develUpgrade kernel-devel-matchedUpgrade kernel-debug-coreUpgrade kernel-debugUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-develUpgrade kernel-debug-devel-matchedUpgrade bpftool-debuginfoUpgrade kernel-debug-develUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-headersUpgrade kernel-modules-extra | Aug 22, 2024 | Apr 17, 2024 |
| Suse | — | Upgrade kernel-develUpgrade dtb-mediatekUpgrade gfs2-kmp-azureUpgrade kernel-rtUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-optionalUpgrade kernel-64kb-develUpgrade dtb-lgUpgrade dtb-rockchipUpgrade dlm-kmp-rtUpgrade kernel-symsUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-64kbUpgrade dtb-alteraUpgrade kselftests-kmp-64kbUpgrade dtb-caviumUpgrade kernel-devel-rtUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade dtb-sprdUpgrade kernel-rt-livepatchUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-syms-azureUpgrade dtb-armUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade dtb-xilinxUpgrade kernel-debugUpgrade kernel-rt-develUpgrade kernel-64kb-extraUpgrade dtb-allwinnerUpgrade gfs2-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade dtb-nvidiaUpgrade dtb-hisiliconUpgrade dtb-exynosUpgrade cluster-md-kmp-azureUpgrade cluster-md-kmp-rtUpgrade kernel-default-vdsoUpgrade dtb-qcomUpgrade kernel-64kb-livepatch-develUpgrade kernel-sourceUpgrade kernel-zfcpdumpUpgrade dtb-renesasUpgrade kernel-docsUpgrade kernel-rt-extraUpgrade kernel-syms-rtUpgrade dtb-freescaleUpgrade kernel-obs-buildUpgrade kernel-debug-develUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-debug-vdsoUpgrade kernel-azure-livepatch-develUpgrade dtb-socionextUpgrade reiserfs-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-default-extraUpgrade kselftests-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-azureUpgrade dtb-amazonUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-azure-develUpgrade dtb-appleUpgrade kernel-obs-qaUpgrade kernel-docs-htmlUpgrade kernel-default-baseUpgrade kernel-macrosUpgrade kernel-azure-extraUpgrade kernel-azureUpgrade kernel-default-develUpgrade dtb-amlogicUpgrade dtb-amdUpgrade kernel-defaultUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-64kbUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-source-rtUpgrade ocfs2-kmp-rtUpgrade dtb-apmUpgrade kernel-devel-azureUpgrade kernel-default-livepatchUpgrade kernel-rt-optionalUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade dtb-broadcomUpgrade kernel-rt_debug-vdsoUpgrade dtb-marvell | May 15, 2024 | Apr 17, 2024 |
| Ubuntu | — | Upgrade linux-raspi-realtime | Feb 11, 2025 | Apr 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Apr 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub