CVE-2024-46717

What it actually does

Double-release of SHAMPO header pages in mlx5e RX path under conditions of no skb yet, header_size==0, and header_index at page boundary, resulting in use-after-free on kernel memory pages.

Why it matters to the business

Systems using affected Linux kernels with Mellanox mlx5e NICs and SHAMPO may experience crashes or potential kernel-level code execution during network traffic processing; low immediate risk given low EPSS and no KEV listing, but upgrade urgency applies for production network servers.

How an attack unfolds

An attacker sends specially crafted network packets to a vulnerable mlx5e interface to satisfy the three conditions triggering incorrect page release; the resulting use-after-free can be leveraged for memory corruption leading to denial of service or privilege escalation. No named threat actors have been linked to this specific flaw.

How to fix it

Upgrade the Linux kernel to commit 03924d117625ecb10ee3c9b65930bcb2c37ae629 or later equivalent stable release containing the fix for incorrect page release.

How to confirm the fix worked

Verify running kernel contains commit 03924d117625ecb10ee3c9b65930bcb2c37ae629; inspect mlx5e source for the corrected release logic and test under the three triggering conditions.

Typical attack path

1. Attacker delivers crafted RX packets targeting mlx5e SHAMPO handling
2. Kernel enters mlx5e_handle_rx_cqe_mpwrq_shampo with no skb, zero header size, and boundary page index
3. Incorrect data page is attached to skb while SHAMPO header page is double-released
4. Use-after-free is triggered on subsequent access or free operations

How to detect it

Review kernel logs for mlx5e double-free or page-release warnings and oops traces involving mlx5e_handle_rx_cqe_mpwrq_shampo; correlate with network traffic spikes on affected interfaces.

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on all systems using mlx5e with SHAMPO
• Prioritize patching of externally reachable servers and hypervisors
• Monitor upstream stable kernel releases for backports