CVE-2024-36007

What it actually does

Incorrect reset of entry markers (while resetting chunk marker to NULL) in mlxsw spectrum_acl_tcam rehash delayed work allows migration to resume from an entry outside the current chunk, causing chunk structures to be treated as entries and triggering warnings in mlxsw_afk_encode during filter migration.

Why it matters to the business

Can produce kernel warnings and potential instability on systems using Mellanox Spectrum switches, leading to operational disruptions in network environments; low exploitation likelihood but requires prompt patching of widely deployed Linux kernels.

How an attack unfolds

A local attacker with access to trigger ACL TCAM operations induces an error during the rehash work's filter migration between regions; the inconsistent markers cause invalid iteration, resulting in warnings or degraded kernel behavior without requiring remote access.

How to fix it

Update the Linux kernel to include commit 0b88631855026b55cad901ac28d081e0f358e596 (or equivalent stable backports) in the mlxsw spectrum_acl_tcam code; apply the helper that resets all markers on error and new rehash starts.

How to confirm the fix worked

Confirm the running kernel contains commit 0b88631855026b55cad901ac28d081e0f358e596; reproduce rehash workloads and verify absence of mlxsw_afk_encode warnings or related call traces in dmesg.

Typical attack path

1. Obtain local user access on an affected Linux kernel system
2. Trigger mlxsw ACL TCAM vregion rehash delayed work via network configuration changes
3. Force an error condition during chunk/entry migration to exploit unreset markers
4. Observe resulting warnings or system impact in mlxsw_afk_encode

How to detect it

Inspect kernel logs (dmesg/syslog) for WARNINGs from mlxsw_afk_encode or call traces involving mlxsw_sp_acl_tcam_vregion_rehash_work and kworker threads; correlate with tainted kernel messages or rehash-related activity.

What your security team should do

• Prioritize kernel updates on all systems using mlxsw/Mellanox Spectrum hardware
• Enable kernel logging and alerting for mlxsw_sp_acl_tcam_vregion_rehash_work warnings
• Test patched kernels in lab environments before broad deployment
• Review downstream package maintainers for timely distribution updates