CVE-2024-35855

What it actually does

Use-after-free in mlxsw spectrum_acl_tcam due to concurrent access of 'ventry->entry' by activity-update and rehash delayed works without proper locking under vregion->lock, allowing slab memory to be freed then read.

Why it matters to the business

Kernel crashes or potential local privilege escalation on systems using Mellanox Spectrum switches, causing downtime or full host compromise; low public exploitability but affects core Linux networking stacks with high ecosystem prevalence.

How an attack unfolds

An attacker with local access triggers concurrent ACL rule activity queries and vregion rehash migrations; the activity worker dereferences a pointer that the rehash worker has already freed, leading to KASAN-detected slab-use-after-free that can be turned into arbitrary read/write or denial of service.

How to fix it

Upgrade the Linux kernel to the commit 1b73f6e4ea770410a937a8db98f77e52594d23a0 or any later stable tree containing the fix that serializes the activity query under vregion->lock.

How to confirm the fix worked

Confirm the running kernel contains commit 1b73f6e4ea770410a937a8db98f77e52594d23a0; recompile with KASAN and exercise ACL rule activity and rehash workloads to ensure no use-after-free reports appear.

Typical attack path

1. Obtain local code execution on an affected Linux host
2. Configure ACL flower rules that exercise the tcam vregion
3. Force concurrent execution of mlxsw_sp_acl_rule_activity_update_work and mlxsw_sp_acl_tcam_vregion_rehash_work
4. Trigger the window where ventry->entry is freed during migration
5. Read the dangling pointer inside mlxsw_sp_acl_tcam_flower_rule_activity_get

How to detect it

Search kernel logs and KASAN reports for the stack trace containing mlxsw_sp_acl_tcam_flower_rule_activity_get and mlxsw_sp_acl_rule_activity_update_work; inspect kworker threads and slab free/alloc events around mlxsw ACL tcam operations.

• mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140
• BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get
• Read of size 8 at addr ffff8881054ed808 by task kworker
• mlxsw_sp_acl_rule_activity_update_work+0x219/0x400
• mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50

What your security team should do

• Immediately upgrade all affected Linux kernels to a version containing commit 1b73f6e4ea770410a937a8db98f77e52594d23a0
• Prioritize systems exposing Mellanox Spectrum hardware or running mlxsw drivers
• Monitor for kernel oops or KASAN reports referencing mlxsw_sp_acl_tcam_flower_rule_activity_get
• Apply defense-in-depth by restricting unprivileged local access until patches are deployed