CVE-2024-45030

What it actually does

The igb driver miscalculates ring layout by not accounting for large shared info size, allowing the first fraglist to overwrite the second packet head when two packets share a 4K page.

Why it matters to the business

Network data corruption during transmission on affected systems can cause application failures, unreliable connectivity, and potential system instability for organizations relying on igb-based Ethernet hardware.

How an attack unfolds

An attacker triggers the flaw by sending network traffic requiring many fragments such as an SSH connection; the driver places multiple packets into the same page without sufficient buffer accounting, resulting in payload corruption on TX.

How to fix it

Update the Linux kernel to a version containing commit 8ea80ff5d8298356d28077bc30913ed37df65109 or later; rebuild and deploy the updated kernel image on all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 8ea80ff5d8298356d28077bc30913ed37df65109; test SSH and other high-fragment workloads to confirm absence of TX payload corruption.

Typical attack path

1. Identify a target system using the igb driver
2. Initiate network traffic that generates many SKB fragments (e.g., SSH session)
3. Driver selects ring layout that fits two packets in one 4K page
4. First packet's fraglist overwrites the second packet head
5. Corrupted payload is transmitted or processed

How to detect it

Review kernel logs for igb driver warnings or errors during high-fragment TX operations; inspect network traces for unexpected payload corruption patterns on affected interfaces.

What your security team should do

• Prioritize kernel upgrade on all systems using igb hardware within the next maintenance window
• Monitor vendor kernel updates and backports for stable branches
• Test network workloads after patching to validate correct behavior