{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-50001", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T12:17:06.058Z", "datePublished": "2024-10-21T18:02:40.254Z", "dateUpdated": "2026-08-05T11:41:01.165Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:01.165Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix error path in multi-packet WQE transmit\n\nRemove the erroneous unmap in case no DMA mapping was established\n\nThe multi-packet WQE transmit code attempts to obtain a DMA mapping for\nthe skb. This could fail, e.g. under memory pressure, when the IOMMU\ndriver just can't allocate more memory for page tables. While the code\ntries to handle this in the path below the err_unmap label it erroneously\nunmaps one entry from the sq's FIFO list of active mappings. Since the\ncurrent map attempt failed this unmap is removing some random DMA mapping\nthat might still be required. If the PCI function now presents that IOVA,\nthe IOMMU may assumes a rogue DMA access and e.g. on s390 puts the PCI\nfunction in error state.\n\nThe erroneous behavior was seen in a stress-test environment that created\nmemory pressure." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is triggered by a local DMA/IOMMU resource-allocation failure in the NIC transmit path, not by remote packet content — no attacker-supplied network data reaches or influences the faulting condition. A local user reliably drives both halves: small linear skbs that take the MPWQE path via ordinary socket sends, and the memory pressure that makes dma_map_single() fail.\nAC:L - Memory pressure is squarely within an unprivileged attacker's influence (anonymous allocations, plus IOVA/swiotlb slot exhaustion from high-rate concurrent DMA mappings), and reaching mlx5e_sq_xmit_mpwqe() is just send() in a loop; the fix's own reproduction was a stress-test environment an attacker can manufacture. MPWQE is enabled by default on all capable ConnectX hardware, so no rare configuration is needed.\nPR:L - Tracing mlx5e_xmit() → mlx5e_sq_xmit_mpwqe() shows no capability check, namespace gate, or privileged socket requirement anywhere on the path — any unprivileged user transmitting on any socket over the NIC reaches it. Only a basic local account is required.\nUI:N - The vulnerability is triggered entirely by the attacker's own transmit traffic and memory allocations. No victim action, configuration change, or interaction of any kind is needed.\nS:U - The damage stays within the kernel's own security authority and inside the NIC's existing IOMMU domain — the IOMMU detects the rogue access rather than being bypassed, and the device never escapes to a different authority. This is a standard in-kernel driver defect, not a guest-to-host or DMA-boundary escape.\nC:H - The premature and double unmaps release IOVAs and swiotlb bounce slots that are still referenced by posted TX descriptors; once the DMA allocator reassigns them, the NIC reads and transmits the contents of unrelated kernel pages onto the network. This is an unbounded kernel-memory disclosure primitive exfiltrated to the wire, not a small bounded read.\nI:H - This is DMA mapping-lifetime corruption: IOVAs and bounce slots are freed while live and then handed to a second owner, and the permanently skewed dma_fifo_pc/cc accounting misattributes every subsequent unmap for the SQ's lifetime. Mixed-direction reuse of a doubly-freed slot lets a device write into a buffer whose owner expects different data, and in-flight packet payloads are substituted.\nA:H - The documented outcome is that the IOMMU treats the presented IOVA as a rogue DMA access and places the PCI function in error state; on s390 a failed zpci_event_attempt_error_recovery() escalates to pci_channel_io_perm_failure, permanently disabling the NIC and destroying network connectivity. On other platforms it causes DMAR/SMMU faults, SQ error-CQE recovery, and a compounding DMA mapping leak that drives further failures." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/en_tx.c" ], "versions": [ { "version": "5af75c747e2a868abbf8611494b50ed5e076fca7", "lessThan": "ca36d6c1a49b6965c86dd528a73f38bc62d9c625", "status": "affected", "versionType": "git" }, { "version": "5af75c747e2a868abbf8611494b50ed5e076fca7", "lessThan": "ce828b347cf1b3c1b12b091d02463c35ce5097f5", "status": "affected", "versionType": "git" }, { "version": "5af75c747e2a868abbf8611494b50ed5e076fca7", "lessThan": "fc357e78176945ca7bcacf92ab794b9ccd41b4f4", "status": "affected", "versionType": "git" }, { "version": "5af75c747e2a868abbf8611494b50ed5e076fca7", "lessThan": "26fad69b34fcba80d5c7d9e651f628e6ac927754", "status": "affected", "versionType": "git" }, { "version": "5af75c747e2a868abbf8611494b50ed5e076fca7", "lessThan": "ecf310aaf256acbc8182189fe0aa1021c3ddef72", "status": "affected", "versionType": "git" }, { "version": "5af75c747e2a868abbf8611494b50ed5e076fca7", "lessThan": "8bb8c12fb5e2b1f03d603d493c92941676f109b5", "status": "affected", "versionType": "git" }, { "version": "5af75c747e2a868abbf8611494b50ed5e076fca7", "lessThan": "2bcae12c795f32ddfbf8c80d1b5f1d3286341c32", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/en_tx.c" ], "versions": [ { "version": "5.10", "status": "affected" }, { "version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.227", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.55", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.14", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.3", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.10.227" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.55" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.10.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.11.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ca36d6c1a49b6965c86dd528a73f38bc62d9c625" }, { "url": "https://git.kernel.org/stable/c/ce828b347cf1b3c1b12b091d02463c35ce5097f5" }, { "url": "https://git.kernel.org/stable/c/fc357e78176945ca7bcacf92ab794b9ccd41b4f4" }, { "url": "https://git.kernel.org/stable/c/26fad69b34fcba80d5c7d9e651f628e6ac927754" }, { "url": "https://git.kernel.org/stable/c/ecf310aaf256acbc8182189fe0aa1021c3ddef72" }, { "url": "https://git.kernel.org/stable/c/8bb8c12fb5e2b1f03d603d493c92941676f109b5" }, { "url": "https://git.kernel.org/stable/c/2bcae12c795f32ddfbf8c80d1b5f1d3286341c32" } ], "title": "net/mlx5: Fix error path in multi-packet WQE transmit", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-50001", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-22T13:29:57.852551Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:38:41.116Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:24:17.517Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T11:59:37.348Z" }, "affected": [ { "vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.2", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.2", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.2", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html" } ] } ] } }