CVE-2024-47734

What it actually does

Triggers unnecessary WARN_ON_ONCE() and excessive netdev_err logs in the bonding driver's XDP handling when mixing supported and unsupported XDP configurations across bond devices.

Why it matters to the business

Leads to log flooding that can obscure important system events, increase storage and analysis costs, and complicate incident response for organizations running affected Linux kernels.

How an attack unfolds

An attacker or fuzzer sets up veth pairs and multiple bond devices, attaches an XDP program returning XDP_TX to a slave on an unsupported bond mode while another bond has XDP driver mode enabled, forcing the xdp_master_redirect path to emit the warning.

How to fix it

Update the Linux kernel to a version containing the fix that removes the WARN_ON_ONCE call and adds rate limiting to the netdev_err message.

How to confirm the fix worked

After patching, reproduce the original syzbot configuration and confirm that neither the WARN_ON_ONCE nor repeated netdev_err messages appear in the kernel log.

Typical attack path

1. Create veth interface pairs
2. Create one XDP-supported bond and one unsupported bond (e.g., mode 6)
3. Attach XDP driver program to the supported bond
4. Attach generic XDP program returning XDP_TX to a slave of the unsupported bond
5. Bring interfaces up to trigger the redirect condition

How to detect it

Search kernel logs and audit trails for repeated messages containing bond_xdp_get_xmit_slave or xdp_master_redirect warnings on systems with bonding and XDP enabled.

What your security team should do

• Prioritize kernel updates on systems using bonding with XDP
• Review and tune kernel log rate limits to reduce noise from similar driver warnings
• Monitor for downstream dependent packages that ship this kernel fix