CVE-2024-50000

What it actually does

NULL pointer dereference in mlx5e_tir_builder_alloc() when kvzalloc() returns NULL and the modify field is immediately accessed.

Why it matters to the business

Kernel crashes or denial of service on systems using Mellanox mlx5 Ethernet drivers under memory pressure, causing unplanned downtime and potential loss of network connectivity in affected Linux environments; widespread upstream prevalence increases exposure across distributions.

How an attack unfolds

An attacker triggers the mlx5e_tir_builder_alloc() code path during low-memory conditions so that kvzalloc() fails, resulting in immediate dereference of a NULL pointer and a kernel fault. Listed threat actor campaigns involving Linux kernel memory issues provide context for potential targeted attempts.

How to fix it

Upgrade affected kernels to the fixed commit 4655456a64a0f936098c8432bac64e7176bd2aff or apply package updates such as pcs 0:0.10.10-4.el8 on Rocky Linux 8; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 4655456a64a0f936098c8432bac64e7176bd2aff or the updated package version; inspect source for the kvzalloc NULL check before the modify field access.

Typical attack path

1. Identify Linux systems using the mlx5 Ethernet driver
2. Induce or wait for memory pressure on the target
3. Trigger network configuration or traffic that invokes TIR builder allocation
4. Cause kvzalloc() failure leading to NULL dereference and crash

How to detect it

Review kernel logs and crash dumps for NULL dereference faults originating from mlx5e_tir_builder_alloc under memory pressure; correlate with threat actor activity involving Linux kernel memory corruption.

What your security team should do

• Apply the referenced kernel or package updates as soon as possible given upstream exposure
• Prioritize reboot of systems with mlx5 hardware after patching
• Monitor kernel logs for oops/panic entries mentioning mlx5e_tir_builder_alloc