Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2024-42142

net/mlx5: E-switch, Create ingress ACL when needed

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-switch, Create ingress ACL when needed Currently, ingress acl is used for three features. It is created only when vport metadata match and prio tag are enabled. But active-backup lag mode also uses it. It is independent of vport metadata match and prio tag. And vport metadata match can be disabled using the following devlink command: # devlink dev param set pci/0000:08:00.0 name esw_port_metadata \ value false cmode runtime If ingress acl is not created, will hit panic when creating drop rule for active-backup lag mode. If always create it, there will be about 5% performance degradation. Fix it by creating ingress acl when needed. If esw_port_metadata is true, ingress acl exists, then create drop rule using existing ingress acl. If esw_port_metadata is false, create ingress acl and then create drop rule.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1749c4c51c16e3e078faae0a876d01bafb187a74 to < bc3ff8d3c05044de57865ebbb78cca8f7da3e595affected
  • 1749c4c51c16e3e078faae0a876d01bafb187a74 to < 3e3551f8702978cd2221d2614ca6d6727e785324affected
  • 1749c4c51c16e3e078faae0a876d01bafb187a74 to < 83bc1a129f7fd0d7d05036ceb7ee69102624e320affected
  • 1749c4c51c16e3e078faae0a876d01bafb187a74 to < b20c2fb45470d0c7a603613c9cfa5d45720e17f2affected

Linux Linux

Default version status: affected

  • 5.18affected
  • 0 to < 5.18unaffected
  • 6.1.98 to ≤ 6.1.*unaffected
  • 6.6.39 to ≤ 6.6.*unaffected
  • 6.9.9 to ≤ 6.9.*unaffected
  • 6.10 to ≤ *unaffected

References