In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Add a timeout to acquire the command queue semaphore
Prevent forced completion handling on an entry that has not yet been assigned an index, causing an out of bounds access on idx = -22. Instead of waiting indefinitely for the sem, blocking flow now waits for index to be allocated or a sem acquisition timeout before beginning the timer for FW completion.
Kernel log example: mlx5core 0000:06:00.0: waitfunchandleexectimeout:1128:(pid 185911): cmd[-22]: CREATEUCTX(0xa04) No done completion
{ "vanir_signatures": [ { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@485d65e1357123a697c591a5aeb773994b247ad7", "signature_type": "Function", "target": { "function": "cmd_work_handler", "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "length": 2434.0, "function_hash": "333065274592254466663363356522829302490" }, "id": "CVE-2024-38556-0dedc03e" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4baae687a20ef2b82fde12de3c04461e6f2521d6", "signature_type": "Function", "target": { "function": "mlx5_cmd_invoke", "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "length": 1364.0, "function_hash": "169984921903592187804391621406136837614" }, "id": "CVE-2024-38556-16ae732a" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4baae687a20ef2b82fde12de3c04461e6f2521d6", "signature_type": "Line", "target": { "file": "include/linux/mlx5/driver.h" }, "deprecated": false, "digest": { "line_hashes": [ "269377398942522544973971559309301391972", "331058158558739928660435876455236242942", "175395883810040910918777853008920996621", "158539366240670814626896523123763561772" ], "threshold": 0.9 }, "id": "CVE-2024-38556-16f93c0c" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9caccdd42e999b74303c9b0643300073ed5d319", "signature_type": "Function", "target": { "function": "cmd_work_handler", "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "length": 2434.0, "function_hash": "333065274592254466663363356522829302490" }, "id": "CVE-2024-38556-1ba7ae73" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9caccdd42e999b74303c9b0643300073ed5d319", "signature_type": "Line", "target": { "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "line_hashes": [ "76160477291941642560021555118753851323", "236492996189426350723233170946620741354", "329076368686114563284896441270544758186", "159003316840577673451490859809214079860", "8481538338259221376321315905279399259", "102219332401628563442773155869270719547", "46205109418703651730237880336999082589", "339173748282281320418857009964505845558", "55301092970709106900794084081582196258", "180913008825168477072324397564879512692", "279270454977488076148461912647366919933", "314742164118410390253355488723767877281", "319001661033474524153726671916394677473", "331805395597633276576105522673569087030", "275641857206545147642865819489224829856", "128607568385682165075249383533496501872", "271904361760677557573330503257284604075", "327274522244611140467094915359203032654", "138223749074649713975653972481962938958", "45237413923746134639463542057807629268", "39114224553922248858487962219081878003", "44483980834584254387744812348525942437", "95977493222047379188762718205686466300", "330857481147249303835480549860208374697", "260567812563995532887881850390547714712", "1583684688430834803743905911637839204", "307104819894553529506177865435601331838", "55687830098349657651953844730566073637", "318720564805701593893727329145142055240", "173260041310286511741759105106576118523", "241731256021663332955312320356550014033", "190001795129597808954099747877565942632", "232591366246552243055822822339607324710", "253184811585962450463746704363342580997", "43618503297977755071469554983752025569", "257763011790174481236555208502473219173", "11427165551458155405561555484255099961", "201244570309231923025861037771588186429", "137229003222751618052624158605094516039", "107017352143614356163223226993471671013", "200684424083832854615228891985181000313", "86198572377991781808607280819598471025", "232520011358065244410546826259022840206", "248209535912500836677170943385603564042" ], "threshold": 0.9 }, "id": "CVE-2024-38556-35d813f1" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@485d65e1357123a697c591a5aeb773994b247ad7", "signature_type": "Line", "target": { "file": "include/linux/mlx5/driver.h" }, "deprecated": false, "digest": { "line_hashes": [ "269377398942522544973971559309301391972", "331058158558739928660435876455236242942", "175395883810040910918777853008920996621", "158539366240670814626896523123763561772" ], "threshold": 0.9 }, "id": "CVE-2024-38556-59b6e31f" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9caccdd42e999b74303c9b0643300073ed5d319", "signature_type": "Line", "target": { "file": "include/linux/mlx5/driver.h" }, "deprecated": false, "digest": { "line_hashes": [ "269377398942522544973971559309301391972", "331058158558739928660435876455236242942", "175395883810040910918777853008920996621", "158539366240670814626896523123763561772" ], "threshold": 0.9 }, "id": "CVE-2024-38556-5b6b226f" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9caccdd42e999b74303c9b0643300073ed5d319", "signature_type": "Function", "target": { "function": "mlx5_cmd_invoke", "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "length": 1351.0, "function_hash": "190881677575825245000590202902650258406" }, "id": "CVE-2024-38556-6ccc9a97" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d0962d05c93de391ce85f6e764df895f47c8918", "signature_type": "Function", "target": { "function": "mlx5_cmd_invoke", "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "length": 1351.0, "function_hash": "190881677575825245000590202902650258406" }, "id": "CVE-2024-38556-718105c5" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4baae687a20ef2b82fde12de3c04461e6f2521d6", "signature_type": "Function", "target": { "function": "wait_func", "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "length": 918.0, "function_hash": "71696492232550565251968685049325067264" }, "id": "CVE-2024-38556-747e001a" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4baae687a20ef2b82fde12de3c04461e6f2521d6", "signature_type": "Line", "target": { "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "line_hashes": [ "76160477291941642560021555118753851323", "236492996189426350723233170946620741354", "329076368686114563284896441270544758186", "159003316840577673451490859809214079860", "8481538338259221376321315905279399259", "102219332401628563442773155869270719547", "46205109418703651730237880336999082589", "339173748282281320418857009964505845558", "55301092970709106900794084081582196258", "180913008825168477072324397564879512692", "279270454977488076148461912647366919933", "314742164118410390253355488723767877281", "319001661033474524153726671916394677473", "331805395597633276576105522673569087030", "275641857206545147642865819489224829856", "128607568385682165075249383533496501872", "271904361760677557573330503257284604075", "327274522244611140467094915359203032654", "138223749074649713975653972481962938958", "45237413923746134639463542057807629268", "39114224553922248858487962219081878003", "44483980834584254387744812348525942437", "95977493222047379188762718205686466300", "330857481147249303835480549860208374697", "260567812563995532887881850390547714712", "1583684688430834803743905911637839204", "307104819894553529506177865435601331838", "55687830098349657651953844730566073637", "318720564805701593893727329145142055240", "173260041310286511741759105106576118523", "241731256021663332955312320356550014033", "190001795129597808954099747877565942632", "232591366246552243055822822339607324710", "253184811585962450463746704363342580997", "43618503297977755071469554983752025569", "257763011790174481236555208502473219173", "11427165551458155405561555484255099961", "201244570309231923025861037771588186429", "137229003222751618052624158605094516039", "107017352143614356163223226993471671013", "200684424083832854615228891985181000313", "86198572377991781808607280819598471025", "232520011358065244410546826259022840206", "254722737460331883144926663188259327676" ], "threshold": 0.9 }, "id": "CVE-2024-38556-85e21305" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@485d65e1357123a697c591a5aeb773994b247ad7", "signature_type": "Function", "target": { "function": "mlx5_cmd_invoke", "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "length": 1351.0, "function_hash": "190881677575825245000590202902650258406" }, "id": "CVE-2024-38556-937aaa08" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4baae687a20ef2b82fde12de3c04461e6f2521d6", "signature_type": "Function", "target": { "function": "cmd_work_handler", "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "length": 2434.0, "function_hash": "333065274592254466663363356522829302490" }, "id": "CVE-2024-38556-9c771745" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d0962d05c93de391ce85f6e764df895f47c8918", "signature_type": "Function", "target": { "function": "wait_func", "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "length": 918.0, "function_hash": "71696492232550565251968685049325067264" }, "id": "CVE-2024-38556-b0469782" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d0962d05c93de391ce85f6e764df895f47c8918", "signature_type": "Line", "target": { "file": "include/linux/mlx5/driver.h" }, "deprecated": false, "digest": { "line_hashes": [ "269377398942522544973971559309301391972", "331058158558739928660435876455236242942", "175395883810040910918777853008920996621", "158539366240670814626896523123763561772" ], "threshold": 0.9 }, "id": "CVE-2024-38556-b233e7b8" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d0962d05c93de391ce85f6e764df895f47c8918", "signature_type": "Function", "target": { "function": "cmd_work_handler", "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "length": 2434.0, "function_hash": "333065274592254466663363356522829302490" }, "id": "CVE-2024-38556-b96233a5" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@485d65e1357123a697c591a5aeb773994b247ad7", "signature_type": "Line", "target": { "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "line_hashes": [ "76160477291941642560021555118753851323", "236492996189426350723233170946620741354", "329076368686114563284896441270544758186", "159003316840577673451490859809214079860", "8481538338259221376321315905279399259", "102219332401628563442773155869270719547", "46205109418703651730237880336999082589", "339173748282281320418857009964505845558", "55301092970709106900794084081582196258", "180913008825168477072324397564879512692", "279270454977488076148461912647366919933", "314742164118410390253355488723767877281", "319001661033474524153726671916394677473", "331805395597633276576105522673569087030", "275641857206545147642865819489224829856", "128607568385682165075249383533496501872", "271904361760677557573330503257284604075", "327274522244611140467094915359203032654", "138223749074649713975653972481962938958", "45237413923746134639463542057807629268", "39114224553922248858487962219081878003", "44483980834584254387744812348525942437", "95977493222047379188762718205686466300", "330857481147249303835480549860208374697", "260567812563995532887881850390547714712", "1583684688430834803743905911637839204", "307104819894553529506177865435601331838", "55687830098349657651953844730566073637", "318720564805701593893727329145142055240", "173260041310286511741759105106576118523", "241731256021663332955312320356550014033", "190001795129597808954099747877565942632", "232591366246552243055822822339607324710", "253184811585962450463746704363342580997", "43618503297977755071469554983752025569", "257763011790174481236555208502473219173", "11427165551458155405561555484255099961", "201244570309231923025861037771588186429", "137229003222751618052624158605094516039", "107017352143614356163223226993471671013", "200684424083832854615228891985181000313", "86198572377991781808607280819598471025", "232520011358065244410546826259022840206", "248209535912500836677170943385603564042" ], "threshold": 0.9 }, "id": "CVE-2024-38556-bcf32803" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9caccdd42e999b74303c9b0643300073ed5d319", "signature_type": "Function", "target": { "function": "wait_func", "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "length": 918.0, "function_hash": "71696492232550565251968685049325067264" }, "id": "CVE-2024-38556-cdb55342" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d0962d05c93de391ce85f6e764df895f47c8918", "signature_type": "Line", "target": { "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "line_hashes": [ "76160477291941642560021555118753851323", "236492996189426350723233170946620741354", "329076368686114563284896441270544758186", "159003316840577673451490859809214079860", "8481538338259221376321315905279399259", "102219332401628563442773155869270719547", "46205109418703651730237880336999082589", "339173748282281320418857009964505845558", "55301092970709106900794084081582196258", "180913008825168477072324397564879512692", "279270454977488076148461912647366919933", "314742164118410390253355488723767877281", "319001661033474524153726671916394677473", "331805395597633276576105522673569087030", "275641857206545147642865819489224829856", "128607568385682165075249383533496501872", "271904361760677557573330503257284604075", "327274522244611140467094915359203032654", "138223749074649713975653972481962938958", "45237413923746134639463542057807629268", "39114224553922248858487962219081878003", "44483980834584254387744812348525942437", "95977493222047379188762718205686466300", "330857481147249303835480549860208374697", "260567812563995532887881850390547714712", "1583684688430834803743905911637839204", "307104819894553529506177865435601331838", "55687830098349657651953844730566073637", "318720564805701593893727329145142055240", "173260041310286511741759105106576118523", "241731256021663332955312320356550014033", "190001795129597808954099747877565942632", "232591366246552243055822822339607324710", "253184811585962450463746704363342580997", "43618503297977755071469554983752025569", "257763011790174481236555208502473219173", "11427165551458155405561555484255099961", "201244570309231923025861037771588186429", "137229003222751618052624158605094516039", "107017352143614356163223226993471671013", "200684424083832854615228891985181000313", "86198572377991781808607280819598471025", "232520011358065244410546826259022840206", "248209535912500836677170943385603564042" ], "threshold": 0.9 }, "id": "CVE-2024-38556-d2b53cd1" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@485d65e1357123a697c591a5aeb773994b247ad7", "signature_type": "Function", "target": { "function": "wait_func", "file": "drivers/net/ethernet/mellanox/mlx5/core/cmd.c" }, "deprecated": false, "digest": { "length": 918.0, "function_hash": "71696492232550565251968685049325067264" }, "id": "CVE-2024-38556-d8640f38" } ] }