CVE-2024-42142

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: E-switch, Create ingress ACL when needed

Currently, ingress acl is used for three features. It is created only

when vport metadata match and prio tag are enabled. But active-backup

lag mode also uses it. It is independent of vport metadata match and

prio tag. And vport metadata match can be disabled using the

following devlink command:

# devlink dev param set pci/0000:08:00.0 name esw_port_metadata \

value false cmode runtime

If ingress acl is not created, will hit panic when creating drop rule

for active-backup lag mode. If always create it, there will be about

5% performance degradation.

Fix it by creating ingress acl when needed. If esw_port_metadata is

true, ingress acl exists, then create drop rule using existing

ingress acl. If esw_port_metadata is false, create ingress acl and

then create drop rule.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References