{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-57932", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-01-19T11:50:08.377Z", "datePublished": "2025-01-21T12:01:29.212Z", "dateUpdated": "2026-08-05T11:46:58.733Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:58.733Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: guard XDP xmit NDO on existence of xdp queues\n\nIn GVE, dedicated XDP queues only exist when an XDP program is installed\nand the interface is up. As such, the NDO XDP XMIT callback should\nreturn early if either of these conditions are false.\n\nIn the case of no loaded XDP program, priv->num_xdp_queues=0 which can\ncause a divide-by-zero error, and in the case of interface down,\nnum_xdp_queues remains untouched to persist XDP queue count for the next\ninterface up, but the TX pointer itself would be NULL.\n\nThe XDP xmit callback also needs to synchronize with a device\ntransitioning from open to close. This synchronization will happen via\nthe GVE_PRIV_FLAGS_NAPI_ENABLED bit along with a synchronize_net() call,\nwhich waits for any RCU critical sections at call-time to complete." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable NDO is reached purely from the receive softirq path — a remote frame arrives on any NIC, the XDP program calls bpf_redirect_map() to the gve interface, and xdp_do_redirect()/bq_xmit_all() invokes gve_xdp_xmit(); no local access is needed by the attacker, only network traffic sent to the host.\nAC:L - The divide-by-zero variant is fully deterministic and needs no race — gve advertises NETDEV_XDP_ACT_NDO_XMIT at probe time regardless of whether an XDP program is loaded, so the first redirected packet crashes the host; for the close/unload race the attacker drives one side by saturating the redirect path and can retry indefinitely.\nPR:N - The trigger is an unauthenticated packet on the wire; the attacker needs no account, credentials, or any privilege on the target — the XDP redirect configuration is a property of the victim host, not something the attacker must possess.\nUI:N - No victim action is required; the crash or use-after-free happens automatically in NAPI context when the redirected frame is processed.\nS:U - The corruption and crash are confined to the host kernel's own memory and security authority, with no crossing into a hypervisor, IOMMU, or other trust boundary.\nC:H - The unsynchronized close/XDP-unload race (the reason the fix adds synchronize_net()) leaves gve_xdp_xmit writing to and reading from a freed gve_tx_ring, freed tx->desc/q_resources DMA memory, and a freed queue-page-list FIFO; such a use-after-free on reallocated kernel memory yields a disclosure primitive.\nI:H - The use-after-free window lets attacker-controlled packet bytes be memcpy'd into freed, reallocatable QPL pages (memcpy(tx->tx_fifo.base + iov_offset, data, len)) along with descriptor and doorbell writes into freed DMA-coherent memory — an attacker-influenced write into arbitrary reused kernel allocations.\nA:H - Both the smp_processor_id() % 0 divide-by-zero and the priv->tx == NULL dereference occur in softirq context, where oops_end() escalates to panic(\"Fatal exception in interrupt\"), producing an immediate whole-system crash that a remote attacker can trigger repeatedly." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/google/gve/gve_main.c", "drivers/net/ethernet/google/gve/gve_tx.c" ], "versions": [ { "version": "39a7f4aa3e4a7947614cf1d5c27abba3300adb1e", "lessThan": "cbe9eb2c39d09f3c8574febcfa39d8c09d0c7cb5", "status": "affected", "versionType": "git" }, { "version": "39a7f4aa3e4a7947614cf1d5c27abba3300adb1e", "lessThan": "35f44eed5828cf1bc7e760d1993ed8549ba41c7b", "status": "affected", "versionType": "git" }, { "version": "39a7f4aa3e4a7947614cf1d5c27abba3300adb1e", "lessThan": "ff7c2dea9dd1a436fc79d6273adffdcc4a7ffea3", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/google/gve/gve_main.c", "drivers/net/ethernet/google/gve/gve_tx.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.70", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.9", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.70" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cbe9eb2c39d09f3c8574febcfa39d8c09d0c7cb5" }, { "url": "https://git.kernel.org/stable/c/35f44eed5828cf1bc7e760d1993ed8549ba41c7b" }, { "url": "https://git.kernel.org/stable/c/ff7c2dea9dd1a436fc79d6273adffdcc4a7ffea3" } ], "title": "gve: guard XDP xmit NDO on existence of xdp queues", "x_generator": { "engine": "bippy-1.2.0" } } } }