{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-35835","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-17T13:50:33.103Z","datePublished":"2024-05-17T14:02:23.469Z","dateUpdated":"2026-08-05T11:30:13.382Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:30:13.382Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix a double-free in arfs_create_groups\n\nWhen `in` allocated by kvzalloc fails, arfs_create_groups will free\nft->g and return an error. However, arfs_create_table, the only caller of\narfs_create_groups, will hold this error and call to\nmlx5e_destroy_flow_table, in which the ft->g will be freed again."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Every path into `arfs_create_groups()` is a local device-lifecycle event — `finit_module`/auxiliary-PCI probe or rebind, `_mlx5e_resume()`, a devlink `DEVLINK_CMD_ESWITCH_SET` profile change, VF representor attach, or IPoIB child-interface creation. No remote or adjacent peer data reaches this code, so the attacker must already be on the host.\nAC:L - The gating condition is a `kvzalloc(GFP_KERNEL)` failure, which a local attacker influences directly by driving system memory pressure, and the triggering events (eswitch mode toggles, driver rebind, IPoIB child creation, resume) are repeatable on demand. Once the allocation fails the double free is fully deterministic — there is no race and no memory layout the attacker cannot groom.\nPR:L - The initiating events themselves need administrative privilege (CAP_SYS_MODULE, or devlink's `GENL_ADMIN_PERM` checked against `init_user_ns`, not reachable via user namespaces), but the attacker-supplied half of the condition — the memory pressure that forces the `!in` error path — requires only an ordinary unprivileged local account running alongside routine administrative or power-management activity.\nUI:N - No victim action beyond ordinary system operation is required; the faulty cleanup executes automatically inside `arfs_create_table()` whenever the `in` allocation fails. The attacker supplies the memory pressure and simply waits for, or races with, normal driver/devlink activity.\nS:U - The corruption is confined to the host kernel's own slab allocator and the mlx5e driver's data structures, within a single security authority. No VM, IOMMU, or sandbox boundary is crossed by the defect.\nC:H - The doubly-freed `ft->g` is a 16-byte object in the shared `kmalloc-16` cache; under the memory pressure that caused the failure it is very likely reallocated between the two `kfree()` calls, so the second free leaves a live object on the freelist. The attacker can reclaim that aliased allocation and read back kernel memory belonging to another owner, giving uncontrolled information disclosure.\nI:H - Freelist aliasing from a double free lets two independent allocations own the same `kmalloc-16` chunk, so attacker-controlled bytes overwrite a live kernel object — a type-confusion/write primitive suitable for control-flow hijacking and privilege escalation. Corrupted SLUB freelist pointers additionally allow steering subsequent allocations to attacker-chosen addresses.\nA:H - Even without successful exploitation, the second `kfree()` of an already-freed pointer trips SLUB double-free/redzone detection or corrupts the freelist, producing a `BUG`, oops, or panic (fatal with `panic_on_warn`). This occurs in the network device bring-up path, taking the machine or its NIC down."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c"],"versions":[{"version":"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c","lessThan":"e3d3ed8c152971dbe64c92c9ecb98fdb52abb629","status":"affected","versionType":"git"},{"version":"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c","lessThan":"2501afe6c4c9829d03abe9a368b83d9ea1b611b7","status":"affected","versionType":"git"},{"version":"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c","lessThan":"cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5","status":"affected","versionType":"git"},{"version":"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c","lessThan":"c57ca114eb00e03274dd38108d07a3750fa3c056","status":"affected","versionType":"git"},{"version":"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c","lessThan":"42876db001bbea7558e8676d1019f08f9390addb","status":"affected","versionType":"git"},{"version":"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c","lessThan":"b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7","status":"affected","versionType":"git"},{"version":"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c","lessThan":"66cc521a739ccd5da057a1cb3d6346c6d0e7619b","status":"affected","versionType":"git"},{"version":"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c","lessThan":"3c6d5189246f590e4e1f167991558bdb72a4738b","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c"],"versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","status":"unaffected","versionType":"semver"},{"version":"4.19.307","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.269","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.210","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.149","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.76","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.15","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.3","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"4.19.307"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.4.269"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.10.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.15.149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.1.76"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.6.15"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.7.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629"},{"url":"https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7"},{"url":"https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5"},{"url":"https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056"},{"url":"https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb"},{"url":"https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7"},{"url":"https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b"},{"url":"https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b"}],"title":"net/mlx5e: fix a double-free in arfs_create_groups","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","description":"CWE-noinfo Not enough information"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-05-17T17:01:13.319923Z","id":"CVE-2024-35835","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-11-06T21:08:42.977Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T03:21:48.621Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","tags":["x_transferred"]}]}]},"dataVersion":"5.2"}