CVE-2024-35853

What it actually does

Memory leak in mlxsw spectrum_acl_tcam rehash logic caused by overwriting and leaking the backup chunk reference during a failed rollback of a failed migration, leading to repeated parman_destroy calls without cleanup.

Why it matters to the business

Kernel memory exhaustion on affected Linux systems using Mellanox Spectrum switches can cause networking instability, performance degradation, or crashes after prolonged operation or repeated rehash attempts; low urgency given 880 days since publication and negligible EPSS trend.

How an attack unfolds

An attacker with local access triggers repeated ACL region rehash operations in the mlxsw driver; if a migration fails and rollback also fails, the unchecked backup chunk overwrite leaks memory until exhaustion occurs, with no known remote or named threat actor exploitation.

How to fix it

Update the Linux kernel to the fixed commit c6f3fa7f5a748bf6e5c4eb742686d6952f854e76 or later stable releases containing this patch; avoid rolling back failed rollbacks in custom builds.

How to confirm the fix worked

Verify kernel git commit contains c6f3fa7f5a748bf6e5c4eb742686d6952f854e76; confirm absence of parman_destroy warnings during mlxsw_sp_acl_tcam_vregion_rehash_work; test rehash under failure injection.

Typical attack path

1. Obtain local access to a system using mlxsw spectrum_acl_tcam
2. Trigger or wait for ACL TCAM rehash delayed work
3. Induce migration failure followed by rollback failure
4. Repeat to accelerate memory leak via repeated parman chunk overwrites

How to detect it

Search kernel logs and dmesg for WARNING messages referencing parman_destroy during mlxsw_sp_acl_tcam_vregion_rehash_work or kworker threads; inspect for repeated migration/rollback patterns in mlxsw ACL code paths.

• WARNING: CPU:.*PID:.*at lib/parman.c:291 parman_destroy+0x17/0x20
• mlxsw_sp_acl_tcam_vregion_rehash_work
• mlxsw_sp_acl_atcam_region_fini
• Tainted: G W
• Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work

What your security team should do

• Apply the referenced kernel commit immediately on all Mellanox Spectrum-based systems
• Monitor kernel logs for parman_destroy warnings from mlxsw worker threads
• Prioritize patching over mitigation since no configuration workaround exists
• Track EPSS and KEV updates given the 880-day exposure window