CVE-2024-35981

What it actually does

The flaw causes an infinite loop in the Linux kernel virtio_net driver when ethtool attempts to set RSS options without a key on devices lacking RSS support, resulting in a zero-length scatter-gather buffer sent to QEMU, which marks the virtio device broken without the kernel detecting the failure in virtqueue_is_broken.

Why it matters to the business

Virtualized Linux systems using virtio networking may experience complete denial of service and system freeze from a simple local command, disrupting workloads in cloud and VM environments; low exploitation likelihood reduces urgency despite the kernel's age since publication.

How an attack unfolds

An attacker with local access to a QEMU VM running affected virtio_net runs ethtool to set RSS hash function, triggering virtnet_set_rxfh and virtnet_commit_rss_command which sends a zero-length buffer; QEMU rejects it via virtio_error marking the device broken, and the kernel loops indefinitely in virtnet_send_command waiting for a response it never receives.

How to fix it

Upgrade the Linux kernel to a version containing commit 539a2b995a4ed93125cb0efae0f793b00ab2158b which prevents sending RSS commands when the feature is unsupported by the device.

How to confirm the fix worked

Confirm the running kernel includes commit 539a2b995a4ed93125cb0efae0f793b00ab2158b or equivalent fix; re-execute the ethtool RSS command and verify the system does not enter an infinite loop or hang.

Typical attack path

1. Execute ethtool -X eth0 hfunc toeplitz locally on affected VM
2. ethtool_set_rxfh invokes virtnet_set_rxfh
3. virtnet_set_rxfh calls virtnet_commit_rss_command with rss_key_size=0
4. Zero-length sg buffer transmitted to QEMU virtqueue
5. QEMU virtio_error sets vdev->broken=true and stops responding
6. Kernel spins forever in virtqueue_get_buf loop without detecting broken state

How to detect it

Search kernel logs for repeated cpu_relax loops in virtnet_send_command or virtqueue_get_buf, and QEMU logs containing virtio zero sized buffer errors; correlate with ethtool process execution on virtio interfaces.

• virtio: zero sized buffers are not allowed
• virtnet_send_command
• virtqueue_is_broken
• ethtool -X.*hfunc toeplitz

What your security team should do

• Apply the kernel fix containing commit 539a2b995a4ed93125cb0efae0f793b00ab2158b on all systems using virtio_net
• Restrict unprivileged ethtool access via capabilities or SELinux policies where feasible
• Monitor kernel and QEMU logs for virtio zero-buffer errors in virtualized deployments