CVE-2024-50094

CVE-2024-50094

High · published November 5, 2024

CVSS v3.1
7.5
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

sfc: Don't invoke xdp_do_flush() from netpoll.

Yury reported a crash in the sfc driver originated from

netpoll_send_udp(). The netconsole sends a message and then netpoll

invokes the driver's NAPI function with a budget of zero. It is

dedicated to allow driver to free TX resources, that it may have used

while sending the packet.

In the netpoll case the driver invokes xdp_do_flush() unconditionally,

leading to crash because bpf_net_context was never assigned.

Invoke xdp_do_flush() only if budget is not zero.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Published
2024-11-05T22:15Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 6.11, < 6.11.46.11.4
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 05 NOV 17:04Z
    sfc: Don't invoke xdp_do_flush() from netpoll.
    cvelistv5