CVE-2024-35901

What it actually does

The mana_get_rxbuf_cfg function forces RX DMA buffer size alignment to a multiple of 64 bytes, allowing a packet slightly larger than MTU+14 to reach skb_put in mana_poll and trigger skb_over_panic, resulting in a kernel BUG and crash.

Why it matters to the business

Systems using the affected Linux kernel with Microsoft Azure MANA network adapters can experience unexpected crashes and loss of network connectivity when receiving certain packet sizes, leading to service disruption and potential data loss in high-availability environments.

How an attack unfolds

An attacker sends a network packet sized just over MTU+14 (such as 1536 bytes) to an interface using the mana driver; the misaligned DMA buffer size causes skb_put to exceed the allocated skb headroom during mana_poll, invoking the kernel panic path.

How to fix it

Upgrade the Linux kernel to a version containing commit ca58927b00385005f488b6a9905ced7a4f719aad or later that removes the 64-byte alignment in mana_get_rxbuf_cfg; apply the fixed package for your distribution and reboot.

How to confirm the fix worked

Confirm the running kernel contains commit ca58927b00385005f488b6a9905ced7a4f719aad; attempt to reproduce the original skb_over_panic dmesg pattern with a 1536-byte packet and verify the packet is now dropped as CQE_RX_TRUNCATED without panic.

Typical attack path

1. Identify hosts exposing MANA network interfaces
2. Craft or replay a packet whose length exceeds MTU+14 but fits the 64-byte alignment
3. Deliver the packet over the wire to trigger mana_poll
4. skb_put executes beyond buffer limits causing skb_over_panic and kernel BUG

How to detect it

Search kernel logs and dmesg for the strings skb_over_panic, skb_panic, and mana_poll; inspect net_rx_action call traces and look for packets near 1536 bytes arriving on MANA devices.

• skb_over_panic: text:ffffffffc043277a len:1536
• kernel BUG at net/core/skbuff.c:192
• RIP: 0010:skb_panic+0x4f/0x60
• mana_poll+0x6fa/0xb50 [mana]

What your security team should do

• Prioritize kernel upgrade on all systems exposing MANA interfaces within the next maintenance window
• Monitor for skb_over_panic messages in kernel logs until patches are deployed
• Restrict inbound traffic to expected MTU sizes where feasible as a temporary control