CVE-2024-35854

What it actually does

Use-after-free in mlxsw spectrum_acl_tcam rehash logic allows a destroyed region to be referenced after a failed filter migration, leading to slab-use-after-free reads/writes in the kernel.

Why it matters to the business

Systems using the mlxsw driver for Mellanox Spectrum switches face risk of kernel crashes, potential privilege escalation, or denial of service; high CVSS and presence in stable kernel trees increase urgency for organizations running affected Linux versions.

How an attack unfolds

An attacker with the ability to trigger ACL TCAM rehash operations (via crafted filter configurations or workload) can cause a migration to fail, leaving filters referencing a freed region; subsequent entry removal operations then access freed memory, enabling use-after-free exploitation for code execution or DoS.

How to fix it

Upgrade the Linux kernel to a version containing commit e118e7ea24d1392878ef85926627c6bc640c4388; rebuild and reboot with the patched mlxsw driver; until then, avoid configurations that exercise ACL TCAM rehash under low-credit conditions.

How to confirm the fix worked

Confirm the running kernel contains e118e7ea24d1392878ef85926627c6bc640c4388 via git describe or kernel version string; test by exercising mlxsw ACL rehash workloads and verifying absence of KASAN reports in mlxsw_sp_acl_ctcam_region_entry_remove.

Typical attack path

1. Obtain local access or ability to influence mlxsw ACL filter setup on an affected kernel
2. Trigger vregion rehash work via credit-based migration conditions
3. Force a migration failure that leaves filters attached to the source region
4. Invoke entry deletion paths that dereference the already-freed region structure
5. Leverage the resulting slab UAF for arbitrary read/write or control-flow hijack

How to detect it

Search kernel logs and KASAN reports for stack traces containing mlxsw_sp_acl_ctcam_region_entry_remove, mlxsw_sp_acl_tcam_vregion_rehash_work, and slab-use-after-free mentions; correlate with worker thread activity on mlxsw_core workqueues.

• mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230
• mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300
• BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam

What your security team should do

• Prioritize kernel upgrade on all systems exposing mlxsw Spectrum hardware within the next patch cycle
• Monitor for kernel oops or KASAN reports referencing mlxsw_sp_acl_tcam_vregion_rehash_work
• Restrict untrusted local users from configuring complex ACL rulesets until patched
• Include the fixed commit hash in automated kernel build and deployment pipelines