CVE-2024-46857 (GCVE-0-2024-46857)

Vulnerability from cvelistv5 – Published: 2024-09-27 12:42 – Updated: 2025-11-03 22:19
VLAI?
Title
net/mlx5: Fix bridge mode operations when there are no VFs
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix bridge mode operations when there are no VFs Currently, trying to set the bridge mode attribute when numvfs=0 leads to a crash: bridge link set dev eth2 hwmode vepa [ 168.967392] BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] [ 168.969989] RIP: 0010:mlx5_add_flow_rules+0x1f/0x300 [mlx5_core] [...] [ 168.976037] Call Trace: [ 168.976188] <TASK> [ 168.978620] _mlx5_eswitch_set_vepa_locked+0x113/0x230 [mlx5_core] [ 168.979074] mlx5_eswitch_set_vepa+0x7f/0xa0 [mlx5_core] [ 168.979471] rtnl_bridge_setlink+0xe9/0x1f0 [ 168.979714] rtnetlink_rcv_msg+0x159/0x400 [ 168.980451] netlink_rcv_skb+0x54/0x100 [ 168.980675] netlink_unicast+0x241/0x360 [ 168.980918] netlink_sendmsg+0x1f6/0x430 [ 168.981162] ____sys_sendmsg+0x3bb/0x3f0 [ 168.982155] ___sys_sendmsg+0x88/0xd0 [ 168.985036] __sys_sendmsg+0x59/0xa0 [ 168.985477] do_syscall_64+0x79/0x150 [ 168.987273] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 168.987773] RIP: 0033:0x7f8f7950f917 (esw->fdb_table.legacy.vepa_fdb is null) The bridge mode is only relevant when there are multiple functions per port. Therefore, prevent setting and getting this setting when there are no VFs. Note that after this change, there are no settings to change on the PF interface using `bridge link` when there are no VFs, so the interface no longer appears in the `bridge link` output.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4b89251de024fb85329e4cbd8fbea551ae6c665c , < 52c4beb79e095e0631b5cac46ed48a2aefe51985 (git)
Affected: 4b89251de024fb85329e4cbd8fbea551ae6c665c , < 65feee671e37f3b6eda0b6af28f204b5bcf7fa50 (git)
Affected: 4b89251de024fb85329e4cbd8fbea551ae6c665c , < 505ae01f75f839b54329164bbfecf24cc1361b31 (git)
Affected: 4b89251de024fb85329e4cbd8fbea551ae6c665c , < b1d305abef4640af1b4f1b4774d513cd81b10cfc (git)
Create a notification for this product.
    Linux Linux Affected: 5.1
Unaffected: 0 , < 5.1 (semver)
Unaffected: 6.1.111 , ≤ 6.1.* (semver)
Unaffected: 6.6.52 , ≤ 6.6.* (semver)
Unaffected: 6.10.11 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46857",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T13:57:53.606649Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T13:57:59.048Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:19:43.251Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "52c4beb79e095e0631b5cac46ed48a2aefe51985",
              "status": "affected",
              "version": "4b89251de024fb85329e4cbd8fbea551ae6c665c",
              "versionType": "git"
            },
            {
              "lessThan": "65feee671e37f3b6eda0b6af28f204b5bcf7fa50",
              "status": "affected",
              "version": "4b89251de024fb85329e4cbd8fbea551ae6c665c",
              "versionType": "git"
            },
            {
              "lessThan": "505ae01f75f839b54329164bbfecf24cc1361b31",
              "status": "affected",
              "version": "4b89251de024fb85329e4cbd8fbea551ae6c665c",
              "versionType": "git"
            },
            {
              "lessThan": "b1d305abef4640af1b4f1b4774d513cd81b10cfc",
              "status": "affected",
              "version": "4b89251de024fb85329e4cbd8fbea551ae6c665c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.111",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.52",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.11",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix bridge mode operations when there are no VFs\n\nCurrently, trying to set the bridge mode attribute when numvfs=0 leads to a\ncrash:\n\nbridge link set dev eth2 hwmode vepa\n\n[  168.967392] BUG: kernel NULL pointer dereference, address: 0000000000000030\n[...]\n[  168.969989] RIP: 0010:mlx5_add_flow_rules+0x1f/0x300 [mlx5_core]\n[...]\n[  168.976037] Call Trace:\n[  168.976188]  \u003cTASK\u003e\n[  168.978620]  _mlx5_eswitch_set_vepa_locked+0x113/0x230 [mlx5_core]\n[  168.979074]  mlx5_eswitch_set_vepa+0x7f/0xa0 [mlx5_core]\n[  168.979471]  rtnl_bridge_setlink+0xe9/0x1f0\n[  168.979714]  rtnetlink_rcv_msg+0x159/0x400\n[  168.980451]  netlink_rcv_skb+0x54/0x100\n[  168.980675]  netlink_unicast+0x241/0x360\n[  168.980918]  netlink_sendmsg+0x1f6/0x430\n[  168.981162]  ____sys_sendmsg+0x3bb/0x3f0\n[  168.982155]  ___sys_sendmsg+0x88/0xd0\n[  168.985036]  __sys_sendmsg+0x59/0xa0\n[  168.985477]  do_syscall_64+0x79/0x150\n[  168.987273]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  168.987773] RIP: 0033:0x7f8f7950f917\n\n(esw-\u003efdb_table.legacy.vepa_fdb is null)\n\nThe bridge mode is only relevant when there are multiple functions per\nport. Therefore, prevent setting and getting this setting when there are no\nVFs.\n\nNote that after this change, there are no settings to change on the PF\ninterface using `bridge link` when there are no VFs, so the interface no\nlonger appears in the `bridge link` output."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T09:36:04.960Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/52c4beb79e095e0631b5cac46ed48a2aefe51985"
        },
        {
          "url": "https://git.kernel.org/stable/c/65feee671e37f3b6eda0b6af28f204b5bcf7fa50"
        },
        {
          "url": "https://git.kernel.org/stable/c/505ae01f75f839b54329164bbfecf24cc1361b31"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1d305abef4640af1b4f1b4774d513cd81b10cfc"
        }
      ],
      "title": "net/mlx5: Fix bridge mode operations when there are no VFs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46857",
    "datePublished": "2024-09-27T12:42:48.545Z",
    "dateReserved": "2024-09-11T15:12:18.291Z",
    "dateUpdated": "2025-11-03T22:19:43.251Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46857\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T13:57:53.606649Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T13:57:54.710Z\"}}], \"cna\": {\"title\": \"net/mlx5: Fix bridge mode operations when there are no VFs\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4b89251de024fb85329e4cbd8fbea551ae6c665c\", \"lessThan\": \"52c4beb79e095e0631b5cac46ed48a2aefe51985\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4b89251de024fb85329e4cbd8fbea551ae6c665c\", \"lessThan\": \"65feee671e37f3b6eda0b6af28f204b5bcf7fa50\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4b89251de024fb85329e4cbd8fbea551ae6c665c\", \"lessThan\": \"505ae01f75f839b54329164bbfecf24cc1361b31\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4b89251de024fb85329e4cbd8fbea551ae6c665c\", \"lessThan\": \"b1d305abef4640af1b4f1b4774d513cd81b10cfc\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.1\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.111\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.52\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/52c4beb79e095e0631b5cac46ed48a2aefe51985\"}, {\"url\": \"https://git.kernel.org/stable/c/65feee671e37f3b6eda0b6af28f204b5bcf7fa50\"}, {\"url\": \"https://git.kernel.org/stable/c/505ae01f75f839b54329164bbfecf24cc1361b31\"}, {\"url\": \"https://git.kernel.org/stable/c/b1d305abef4640af1b4f1b4774d513cd81b10cfc\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: Fix bridge mode operations when there are no VFs\\n\\nCurrently, trying to set the bridge mode attribute when numvfs=0 leads to a\\ncrash:\\n\\nbridge link set dev eth2 hwmode vepa\\n\\n[  168.967392] BUG: kernel NULL pointer dereference, address: 0000000000000030\\n[...]\\n[  168.969989] RIP: 0010:mlx5_add_flow_rules+0x1f/0x300 [mlx5_core]\\n[...]\\n[  168.976037] Call Trace:\\n[  168.976188]  \u003cTASK\u003e\\n[  168.978620]  _mlx5_eswitch_set_vepa_locked+0x113/0x230 [mlx5_core]\\n[  168.979074]  mlx5_eswitch_set_vepa+0x7f/0xa0 [mlx5_core]\\n[  168.979471]  rtnl_bridge_setlink+0xe9/0x1f0\\n[  168.979714]  rtnetlink_rcv_msg+0x159/0x400\\n[  168.980451]  netlink_rcv_skb+0x54/0x100\\n[  168.980675]  netlink_unicast+0x241/0x360\\n[  168.980918]  netlink_sendmsg+0x1f6/0x430\\n[  168.981162]  ____sys_sendmsg+0x3bb/0x3f0\\n[  168.982155]  ___sys_sendmsg+0x88/0xd0\\n[  168.985036]  __sys_sendmsg+0x59/0xa0\\n[  168.985477]  do_syscall_64+0x79/0x150\\n[  168.987273]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n[  168.987773] RIP: 0033:0x7f8f7950f917\\n\\n(esw-\u003efdb_table.legacy.vepa_fdb is null)\\n\\nThe bridge mode is only relevant when there are multiple functions per\\nport. Therefore, prevent setting and getting this setting when there are no\\nVFs.\\n\\nNote that after this change, there are no settings to change on the PF\\ninterface using `bridge link` when there are no VFs, so the interface no\\nlonger appears in the `bridge link` output.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.111\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.52\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.11\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.1\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:36:04.960Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46857\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:36:04.960Z\", \"dateReserved\": \"2024-09-11T15:12:18.291Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-27T12:42:48.545Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.