CVE-2024-43846

What it actually does

The flaw permits invalid nesting of aggregated objects in the objagg library when hints are used, violating the no-nesting assumption and causing invalid memory access that triggers a general protection fault during operations such as ACL entry handling in mlxsw.

Why it matters to the business

Kernel crashes and denial-of-service conditions on affected Linux systems, especially those using Mellanox networking hardware; 404 downstream dependents increase widespread operational disruption risk for organizations relying on these kernels.

How an attack unfolds

An attacker supplies objects and hints that induce unsupported nesting; the mlxsw_sp_acl_tcam_vregion_rehash_work path then calls mlxsw_sp_acl_erp_bf_insert without validation, dereferencing an invalid address and crashing the kernel. Threat actors from 2024 espionage and financially motivated campaigns have targeted similar Linux kernel resource issues.

How to fix it

Apply the upstream fix that adds an explicit check to error out and warn on nesting attempts; update affected Linux kernels and any downstream packages such as aiohttp to version 3.9.0 where applicable.

How to confirm the fix worked

Confirm the patch by checking for the added nesting validation in objagg code; reproduce the scenario with hint-based aggregation and verify absence of GPF or warnings; inspect kernel logs for the original fault signature.

Typical attack path

1. Identify systems running vulnerable kernel versions with mlxsw or objagg usage
2. Trigger hint-based object aggregation that violates the no-nesting rule
3. Force worker thread execution through mlxsw_sp_acl_tcam_vregion_rehash_work
4. Induce general protection fault via invalid pointer dereference in mlxsw_sp_acl_erp_bf_insert

How to detect it

Search kernel logs and crash dumps for general protection fault entries referencing mlxsw_sp_acl_erp_bf_insert, objagg nesting violations, and call traces involving mlxsw_sp_acl_tcam_vregion_rehash_work; correlate with worker thread activity from kworker processes.

• mlxsw_sp_acl_erp_bf_insert+0x25/0x80
• general protection fault, probably for non-canonical address
• mlxsw_sp_acl_tcam_vregion_rehash_work
• objagg nesting
• Tainted: G W

What your security team should do

• Patch vulnerable kernels immediately given mentions in 2024 exploitation campaigns
• Monitor kernel logs for objagg and mlxsw related faults
• Limit use of hint-based aggregation until patches are deployed
• Inventory systems with 404+ downstream dependents for prioritized rollout