CVE-2024-39293

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-39293
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39293.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-39293
Downstream
Published
2024-06-25T14:22:39Z
Modified
2025-10-15T11:45:56.179576Z
Summary
Revert "xsk: Support redirect to any socket bound to the same umem"
Details

In the Linux kernel, the following vulnerability has been resolved:

Revert "xsk: Support redirect to any socket bound to the same umem"

This reverts commit 2863d665ea41282379f108e4da6c8a2366ba66db.

This patch introduced a potential kernel crash when multiple napi instances redirect to the same AFXDP socket. By removing the queueindex check, it is possible for multiple napi instances to access the Rx ring at the same time, which will result in a corrupted ring state which can lead to a crash when flushing the rings in _xskflush(). This can happen when the linked list of sockets to flush gets corrupted by concurrent accesses. A quick and small fix is not possible, so let us revert this for now.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
2863d665ea41282379f108e4da6c8a2366ba66db
Fixed
19cb40b1064566ea09538289bfcf5bc7ecb9b6f5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
2863d665ea41282379f108e4da6c8a2366ba66db
Fixed
7fcf26b315bbb728036da0862de6b335da83dff2

Affected versions

v6.*

v6.10-rc1
v6.8
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7
v6.9.1
v6.9.2
v6.9.3
v6.9.4

Database specific 

{
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19cb40b1064566ea09538289bfcf5bc7ecb9b6f5",
            "signature_type": "Line",
            "target": {
                "file": "net/xdp/xsk.c"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "251043324052331149688721200004203723451",
                    "292019493854880704029637316491712946083",
                    "126865925841657685296914769473884961674",
                    "176555397121894097202919038158489388664",
                    "76777062381555200218690364254359966099",
                    "216326472142773723175994548483383953715",
                    "241702405708299037817519944927841535799",
                    "172788061696864937753782506153701246687"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-39293-8ae65ddf"
        },
        {
            "signature_version": "v1",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7fcf26b315bbb728036da0862de6b335da83dff2",
            "signature_type": "Line",
            "target": {
                "file": "net/xdp/xsk.c"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "251043324052331149688721200004203723451",
                    "292019493854880704029637316491712946083",
                    "126865925841657685296914769473884961674",
                    "176555397121894097202919038158489388664",
                    "76777062381555200218690364254359966099",
                    "216326472142773723175994548483383953715",
                    "241702405708299037817519944927841535799",
                    "172788061696864937753782506153701246687"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-39293-95d74536"
        },
        {
            "signature_version": "v1",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19cb40b1064566ea09538289bfcf5bc7ecb9b6f5",
            "signature_type": "Function",
            "target": {
                "function": "xsk_rcv_check",
                "file": "net/xdp/xsk.c"
            },
            "deprecated": false,
            "digest": {
                "length": 457.0,
                "function_hash": "260076971953930450733143899860702786056"
            },
            "id": "CVE-2024-39293-c1a72db6"
        },
        {
            "signature_version": "v1",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7fcf26b315bbb728036da0862de6b335da83dff2",
            "signature_type": "Function",
            "target": {
                "function": "xsk_rcv_check",
                "file": "net/xdp/xsk.c"
            },
            "deprecated": false,
            "digest": {
                "length": 457.0,
                "function_hash": "260076971953930450733143899860702786056"
            },
            "id": "CVE-2024-39293-dc2cf613"
        }
    ]
}

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.9.0
Fixed
6.9.5