CVE-2024-50094

What it actually does

Unconditional invocation of xdp_do_flush() from the sfc driver's NAPI poll function when called via netpoll with a zero budget triggers a crash because bpf_net_context is never assigned.

Why it matters to the business

Systems using the sfc driver with netconsole enabled can experience unexpected kernel crashes during routine network logging or debugging, leading to downtime and potential loss of observability in production environments.

How an attack unfolds

An attacker or operator triggers netpoll_send_udp() on a system with the sfc driver, causing the NAPI function to be invoked with budget zero; the driver then calls xdp_do_flush() without the required context, resulting in a crash. Threat actors listed in Linux kernel exploitation campaigns could leverage similar resource initialization issues.

How to fix it

Update affected packages to the fixed versions such as flashplugin-nonfree (Ubuntu:14.04:LTS) fixed in 11.2.202.521ubuntu0.14.04.1; apply the kernel patch ensuring xdp_do_flush() is invoked only when budget is non-zero.

How to confirm the fix worked

Confirm the driver source no longer calls xdp_do_flush() unconditionally in the netpoll path; test by enabling netconsole and verifying no crash occurs on UDP send.

Typical attack path

1. Identify systems running the sfc driver with netconsole or netpoll enabled
2. Send a UDP message via netconsole to invoke netpoll_send_udp()
3. Trigger the driver's NAPI poll routine with budget set to zero
4. Execute the unconditional xdp_do_flush() call leading to crash

How to detect it

Review kernel logs and crash dumps for references to sfc driver, netpoll, and xdp_do_flush calls; check system uptime and netconsole activity around crash times.

What your security team should do

• Apply the kernel fix immediately on all systems using the sfc driver
• Disable netconsole on unpatched systems as a temporary mitigation
• Monitor for kernel oops or panic logs involving sfc and xdp_do_flush