{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-35958","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-17T13:50:33.136Z","datePublished":"2024-05-20T09:41:50.585Z","dateUpdated":"2026-08-05T11:31:12.883Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:31:12.883Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: Fix incorrect descriptor free behavior\n\nENA has two types of TX queues:\n- queues which only process TX packets arriving from the network stack\n- queues which only process TX packets forwarded to it by XDP_REDIRECT\n  or XDP_TX instructions\n\nThe ena_free_tx_bufs() cycles through all descriptors in a TX queue\nand unmaps + frees every descriptor that hasn't been acknowledged yet\nby the device (uncompleted TX transactions).\nThe function assumes that the processed TX queue is necessarily from\nthe first category listed above and ends up using napi_consume_skb()\nfor descriptors belonging to an XDP specific queue.\n\nThis patch solves a bug in which, in case of a VF reset, the\ndescriptors aren't freed correctly, leading to crashes."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The faulty free is on the driver teardown/reset path (`ena_down()` via ifdown, ethtool ring/channel change, MTU change, XDP detach, or watchdog reset), not on the packet receive path, so entry requires local access to the host even though the bytes that form the bogus sk_buff come from remotely received frames.\nAC:L - With XDP_TX/XDP_REDIRECT traffic flowing, the TX ring always holds uncompleted descriptors, so any down/reset deterministically hits `dev_kfree_skb_any()` on an `xdp_frame`; the attacker can both generate the traffic and induce the teardown, with no race or memory-layout condition outside their control.\nPR:L - In deployments where an XDP program is already attached (a configuration precondition, not an attack step), an unprivileged local user can drive the reset through the ENA watchdog paths that also monitor XDP queues — missed TX completions and `RESET_SUSPECTED_POLL_STARVATION` under load — and hypervisor VF resets occur without any local privilege at all.\nUI:N - No victim action is needed; the reset/teardown is initiated by the attacker, the watchdog, or the device itself while XDP frames are in flight.\nS:U - The corruption stays within the kernel's own memory and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Freeing an `xdp_frame` as an `sk_buff` makes the kernel interpret ~200 bytes of packet headroom as sk_buff fields and returns a driver-owned page into `skbuff_cache`, so subsequent skb allocations can alias attacker-visible network buffers, yielding kernel memory disclosure.\nI:H - This is a full type confusion: `consume_skb()` performs a refcount decrement through a bogus `_skb_refdst`, an indirect call through `skb->destructor`, page puts from a fabricated `skb_shinfo`, and a `kmem_cache_free()` of a non-slab pointer, giving heap-corruption and control-flow-hijack primitives with attacker-influenced field values.\nA:H - The commit itself states the incorrect frees lead to crashes on VF reset; slab corruption and wild pointer dereferences reliably produce a kernel oops or panic."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/amazon/ena/ena_netdev.c"],"versions":[{"version":"548c4940b9f1f527f81509468dd60b61418880b6","lessThan":"b26aa765f7437e1bbe8db4c1641b12bd5dd378f0","status":"affected","versionType":"git"},{"version":"548c4940b9f1f527f81509468dd60b61418880b6","lessThan":"fdfbf54d128ab6ab255db138488f9650485795a2","status":"affected","versionType":"git"},{"version":"548c4940b9f1f527f81509468dd60b61418880b6","lessThan":"19ff8fed3338898b70b2aad831386c78564912e1","status":"affected","versionType":"git"},{"version":"548c4940b9f1f527f81509468dd60b61418880b6","lessThan":"5c7f2240d9835a7823d87f7460d8eae9f4e504c7","status":"affected","versionType":"git"},{"version":"548c4940b9f1f527f81509468dd60b61418880b6","lessThan":"c31baa07f01307b7ae05f3ce32b89d8e2ba0cc1d","status":"affected","versionType":"git"},{"version":"548c4940b9f1f527f81509468dd60b61418880b6","lessThan":"bf02d9fe00632d22fa91d34749c7aacf397b6cde","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/amazon/ena/ena_netdev.c"],"versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","status":"unaffected","versionType":"semver"},{"version":"5.10.216","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.156","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.87","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.28","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.8.7","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.10.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.15.156"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.1.87"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.6.28"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.8.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/b26aa765f7437e1bbe8db4c1641b12bd5dd378f0"},{"url":"https://git.kernel.org/stable/c/fdfbf54d128ab6ab255db138488f9650485795a2"},{"url":"https://git.kernel.org/stable/c/19ff8fed3338898b70b2aad831386c78564912e1"},{"url":"https://git.kernel.org/stable/c/5c7f2240d9835a7823d87f7460d8eae9f4e504c7"},{"url":"https://git.kernel.org/stable/c/c31baa07f01307b7ae05f3ce32b89d8e2ba0cc1d"},{"url":"https://git.kernel.org/stable/c/bf02d9fe00632d22fa91d34749c7aacf397b6cde"}],"title":"net: ena: Fix incorrect descriptor free behavior","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","description":"CWE-noinfo Not enough information"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-05-29T18:17:10.294133Z","id":"CVE-2024-35958","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-10-31T20:13:03.442Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T03:21:49.187Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/b26aa765f7437e1bbe8db4c1641b12bd5dd378f0","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/fdfbf54d128ab6ab255db138488f9650485795a2","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/19ff8fed3338898b70b2aad831386c78564912e1","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/5c7f2240d9835a7823d87f7460d8eae9f4e504c7","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/c31baa07f01307b7ae05f3ce32b89d8e2ba0cc1d","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/bf02d9fe00632d22fa91d34749c7aacf397b6cde","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]}]},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T11:53:12.038Z"},"affected":[{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","versions":[{"status":"affected","version":"0","lessThan":"V3.1","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family","versions":[{"status":"unaffected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XCM-/XRM-/XCH-/XRH-300 family","versions":[{"status":"affected","version":"0","lessThan":"V3.1","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","versions":[{"status":"affected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-613116.html"}]}]},"dataVersion":"5.2"}