CVE-2024-36281

What it actually does

The flaw triggers a NULL pointer dereference inside mlx5_modify_header_dealloc when rx_create attempts to clean up IPsec status rules on mlx5 devices; the recent change that stopped allocating a modify_hdr instance was not accompanied by removal of the deallocation call, and an additional rule leak was introduced by populating two status rules.

Why it matters to the business

Systems using Mellanox mlx5 network cards with IPsec offload experience kernel crashes that can cause immediate loss of network connectivity, service outages, and unplanned reboots; the defect affects many stable kernels still in widespread use.

How an attack unfolds

An attacker with the ability to add IPsec security associations on a vulnerable host (via local process or remote configuration) invokes mlx5e_xfrm_add_state which calls rx_add_rule and ultimately rx_create; the incorrect mlx5_modify_header_dealloc call then dereferences a NULL pointer, crashing the kernel.

How to fix it

Upgrade the Linux kernel to version 6.6.33 or later, or apply the commit b0a15cde37a8388e57573686f650a17208ae1212 (and equivalent backports) that replaces the incorrect deallocation logic with mlx5_ipsec_rx_status_destroy.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking the presence of mlx5_ipsec_rx_status_destroy calls in the mlx5 driver source or by verifying the kernel version string matches a patched release; test by adding IPsec rules on mlx5 hardware and confirming no NULL dereference occurs.

Typical attack path

1. Obtain local or remote ability to configure IPsec on the target host
2. Create an IPsec security association that triggers mlx5e_accel_ipsec_fs_add_rule
3. rx_create executes the stale mlx5_modify_header_dealloc path
4. Kernel performs NULL pointer dereference and panics

How to detect it

Search kernel logs for oops messages containing mlx5_modify_header_dealloc and rx_create; inspect audit or system logs for recent IPsec SA creation events immediately preceding the crash on hosts with mlx5 hardware.

What your security team should do

• Prioritize kernel upgrades on any host exposing mlx5 IPsec offload
• Apply the specific fixed commit or 6.6.33+ packages before the next maintenance window
• Restrict IPsec configuration privileges to trusted processes until patches are deployed
• Monitor for kernel oops reports referencing mlx5_modify_header_dealloc