{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-46717","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-09-11T15:12:18.254Z","datePublished":"2024-09-18T06:32:16.791Z","dateUpdated":"2026-08-05T11:38:08.486Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:38:08.486Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: SHAMPO, Fix incorrect page release\n\nUnder the following conditions:\n1) No skb created yet\n2) header_size == 0 (no SHAMPO header)\n3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the\n   last page fragment of a SHAMPO header page)\n\na new skb is formed with a page that is NOT a SHAMPO header page (it\nis a regular data page). Further down in the same function\n(mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from\nheader_index is released. This is wrong and it leads to SHAMPO header\npages being released more than once."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is the mlx5e RX completion handler, driven purely by inbound Ethernet/IP frames processed in NAPI softirq context; any remote host that can send packets to an mlx5 NIC (the standard NIC on internet-facing cloud, datacenter and HPC servers) reaches it. No local access or LAN adjacency is required since ordinary routed IP traffic produces the non-splittable-header CQEs that trigger the bug.\nAC:L - The attacker controls the entire packet stream and thus all three trigger conditions — no in-flight GRO skb, header_size == 0, and header_index landing on a page boundary (1 in every 16 entries) — so at any meaningful traffic rate the condition is hit continuously and repeatably, with no race or memory layout outside attacker influence. SHAMPO/HW-GRO must be enabled on the interface, but that is a common datacenter performance configuration rather than a rare kernel config.\nPR:N - The bug is hit in the driver receive path before any socket lookup, credential check, or authentication; the attacker needs no account, capability, or session on the target. Merely sending packets to the host's mlx5 interface is sufficient.\nUI:N - Exploitation requires only that the target receive packets on an mlx5 interface with HW-GRO active; no victim action of any kind is needed.\nS:U - The premature page release, double free, and DMA-into-freed-page all corrupt kernel memory within the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed by the defect itself.\nC:H - The page-pool double-release causes pages still referenced by live skbs to be recycled and handed to other consumers, and pages reused for unrelated kernel allocations can be re-wrapped into skbs delivered to sockets, disclosing arbitrary kernel memory to a network reader. Any use-after-free of this kind gives a general read primitive.\nI:H - The NIC's header-buffer MKEY still maps the released page, so the device keeps DMA'ing fully attacker-controlled packet-header bytes into memory that has been returned to the page pool and potentially reallocated for arbitrary kernel use, and the double free lets the same page be owned by two consumers. That is an attacker-controlled write into reused kernel memory, exploitable for control-flow hijack.\nA:H - The second release triggers a page_pool refcount underflow WARN_ON (panic under panic_on_warn) and a double free into the page pool, plus header-ring bitmap/pi-ci desync that wedges the RX queue, with the use-after-free itself producing oopses. The condition is remotely and repeatedly triggerable, so a crash is readily achievable."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"],"versions":[{"version":"7957837b816f11eecb9146235bb0715478f4c81f","lessThan":"03924d117625ecb10ee3c9b65930bcb2c37ae629","status":"affected","versionType":"git"},{"version":"7957837b816f11eecb9146235bb0715478f4c81f","lessThan":"ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab","status":"affected","versionType":"git"},{"version":"7957837b816f11eecb9146235bb0715478f4c81f","lessThan":"c909ab41df2b09cde919801c7a7b6bb2cc37ea22","status":"affected","versionType":"git"},{"version":"7957837b816f11eecb9146235bb0715478f4c81f","lessThan":"70bd03b89f20b9bbe51a7f73c4950565a17a45f7","status":"affected","versionType":"git"},{"version":"a4161e4861132d5b324746a260283e87f2d65daf","status":"affected","versionType":"git"},{"version":"5.16.6","lessThan":"5.17","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"],"versions":[{"version":"5.17","status":"affected"},{"version":"0","lessThan":"5.17","status":"unaffected","versionType":"semver"},{"version":"6.1.109","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.50","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.10.9","lessThanOrEqual":"6.10.*","status":"unaffected","versionType":"semver"},{"version":"6.11","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"6.1.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"6.6.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"6.10.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"6.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16.6"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/03924d117625ecb10ee3c9b65930bcb2c37ae629"},{"url":"https://git.kernel.org/stable/c/ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab"},{"url":"https://git.kernel.org/stable/c/c909ab41df2b09cde919801c7a7b6bb2cc37ea22"},{"url":"https://git.kernel.org/stable/c/70bd03b89f20b9bbe51a7f73c4950565a17a45f7"}],"title":"net/mlx5e: SHAMPO, Fix incorrect page release","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-29T14:57:52.467181Z","id":"CVE-2024-46717","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-29T14:58:07.696Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T22:16:49.634Z"}}]}}