CVE-2024-46834
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: ethtool: fail closed if we can't get max channel used in indirection tables Commit 0d1b7d6c9274 ("bnxt: fix crashes when reducing ring count with active RSS contexts") proves that allowing indirection table to contain channels with out of bounds IDs may lead to crashes. Currently the max channel check in the core gets skipped if driver can't fetch the indirection table or when we can't allocate memory. Both of those conditions should be extremely rare but if they do happen we should try to be safe and fail the channel change.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2024-09-27 13:15:15.660000
Last modified
2026-10-30 13:17:36.603000
View original CVE JSON
{
"id": "CVE-2024-46834",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-09-27T13:15:15.660",
"lastModified": "2026-10-30T13:17:36.603",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: fail closed if we can't get max channel used in indirection tables\n\nCommit 0d1b7d6c9274 (\"bnxt: fix crashes when reducing ring count with\nactive RSS contexts\") proves that allowing indirection table to contain\nchannels with out of bounds IDs may lead to crashes. Currently the\nmax channel check in the core gets skipped if driver can't fetch\nthe indirection table or when we can't allocate memory.\n\nBoth of those conditions should be extremely rare but if they do\nhappen we should try to be safe and fail the channel change."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ethtool: error cerrado si no podemos obtener el canal máximo usado en las tablas de indirección. El commit 0d1b7d6c9274 (\"bnxt: corregir fallos al reducir el recuento de anillos con contextos RSS activos\") demuestra que permitir que la tabla de indirección contenga canales con identificadores fuera de los límites puede provocar fallos. Actualmente, la comprobación del canal máximo en el núcleo se omite si el controlador no puede obtener la tabla de indirección o cuando no podemos asignar memoria. Ambas condiciones deberían ser extremadamente raras, pero si ocurren, debemos intentar ser seguros y fallar el cambio de canal."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/ethtool/channels.c",
"net/ethtool/common.c",
"net/ethtool/common.h",
"net/ethtool/ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "d4ab4286276fcd6c155bafdf4422b712068d2516",
"lessThan": "83203ec6f65680109b2048c4f3e501efc14104ba",
"versionType": "git",
"status": "affected"
},
{
"version": "d4ab4286276fcd6c155bafdf4422b712068d2516",
"lessThan": "7e6ff8c58985fbe20d131112aba0a8867cdedc59",
"versionType": "git",
"status": "affected"
},
{
"version": "d4ab4286276fcd6c155bafdf4422b712068d2516",
"lessThan": "101737d8b88dbd4be6010bac398fe810f1950036",
"versionType": "git",
"status": "affected"
},
{
"version": "d4ab4286276fcd6c155bafdf4422b712068d2516",
"lessThan": "2899d58462ba868287d6ff3acad3675e7adf934f",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/ethtool/channels.c",
"net/ethtool/common.c",
"net/ethtool/common.h",
"net/ethtool/ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.6",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.6",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.10.10",
"lessThanOrEqual": "6.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.11",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2024-09-29T14:03:28.433366Z",
"id": "CVE-2024-46834",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.10.10",
"matchCriteriaId": "75C6119D-9E8D-431D-813F-FE84579072CB"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/101737d8b88dbd4be6010bac398fe810f1950036",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2899d58462ba868287d6ff3acad3675e7adf934f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/7e6ff8c58985fbe20d131112aba0a8867cdedc59",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/83203ec6f65680109b2048c4f3e501efc14104ba",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}