CVE-2024-44988

What it actually does

Out-of-bounds read/write access to the mv88e6xxx_chip.ports[] array when an ATU violation is triggered by a CPU Load operation that supplies an SPID value exceeding DSA_MAX_PORTS.

Why it matters to the business

Potential kernel panic, memory corruption, or privilege escalation on systems using Marvell DSA switches, leading to network downtime and possible compromise of affected Linux hosts.

How an attack unfolds

An attacker with the ability to influence ATU entries or trigger CPU Load operations on the switch fabric supplies a maliciously large SPID, causing the driver to index beyond the ports array and corrupt adjacent kernel memory.

How to fix it

Update the Linux kernel to commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 or later; rebuild and deploy the fixed kernel image on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 via git log or kernel version string; test ATU violation paths with SPID values at the array boundary.

Typical attack path

1. Obtain local or remote access sufficient to trigger ATU operations on an mv88e6xxx DSA device
2. Craft or induce an ATU violation using a CPU Load operation with SPID > DSA_MAX_PORTS
3. Trigger out-of-bounds array access leading to memory corruption or crash
4. Leverage resulting corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for oops or panic messages referencing mv88e6xxx and ATU/SPID; correlate with process activity performing switch configuration or CPU Load operations; inspect for unexpected memory corruption indicators in dmesg.

What your security team should do

• Prioritize kernel upgrade on all systems exposing mv88e6xxx DSA hardware within the next patching cycle
• Monitor vendor and distribution advisories for backported fixes in supported LTS kernels
• Restrict unprivileged access to network configuration interfaces that could influence ATU state