CVE-2024-42083

What it actually does

The ionic_run_xdp function in the Linux kernel ionic driver fails to unmap DMA mappings and clear page pointers for all scatter-gather pages (not just the first) when XDP_TX or XDP_REDIRECT actions are taken on multi-buffer jumbo frames, causing those pages to be unexpectedly reused and leading to a general protection fault during xdp_return_frame.

Why it matters to the business

Systems using affected ionic network drivers may experience sudden kernel panics and crashes under normal network traffic involving large frames and XDP processing, resulting in unplanned downtime, loss of network connectivity, and potential data loss until the system is rebooted or the driver is updated.

How an attack unfolds

An attacker sends or triggers receipt of jumbo frames on an ionic interface configured for XDP; when ionic_run_xdp processes the frame and returns XDP_TX or XDP_REDIRECT, the missing cleanup of SG pages causes reuse of unmapped memory, which later triggers a fault in xdp_return_frame during TX cleanup in the NAPI poll path.

How to fix it

Update the Linux kernel to the fixed commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 or later; rebuild and deploy the ionic driver module; test XDP programs that exercise TX and REDIRECT on jumbo frames before returning to production.

How to confirm the fix worked

Confirm the ionic driver source contains the corrected multi-page unmap and pointer reset logic for XDP_TX/XDP_REDIRECT; run network load tests with jumbo frames and XDP_TX/REDIRECT actions while monitoring for absence of the described GPF oops; verify kernel version or git commit after patch application.

Typical attack path

1. Configure or coerce an ionic interface to use XDP with TX or REDIRECT actions
2. Receive a multi-buffer jumbo frame into the RX descriptor ring
3. ionic_run_xdp builds an XDP frame but only cleans the first page on TX/REDIRECT
4. SG pages remain mapped and are reused by subsequent allocations
5. Later TX completion or frame return dereferences invalid memory causing GPF panic

How to detect it

Search kernel logs and dmesg for ionic driver oops messages containing xdp_return_frame, general protection fault, and ionic_tx_clean; correlate with NAPI poll activity and RX descriptor handling on ionic interfaces; review any crash dumps showing page reuse after XDP actions.

What your security team should do

• Prioritize patching ionic-based systems that use XDP to the fixed commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6
• Audit kernel configurations for XDP usage on ionic interfaces and temporarily disable XDP_TX/REDIRECT if immediate patching is not feasible
• Monitor kernel logs for ionic-related GPFs or xdp_return_frame faults as an interim detection measure