CVE-2024-53120

What it actually does

Null pointer dereference in mlx5_tc_ct_entry_add_rule error path when ct_rule_add fails, causing use of uninitialized zone_rule->attr pointer leading to kernel crash.

Why it matters to the business

Kernel panic and system reboot on Linux hosts using mlx5 network cards with connection tracking flow offload, resulting in denial of service and potential disruption to network-intensive workloads.

How an attack unfolds

An attacker triggers an error condition during connection tracking rule installation via nf_flow_offload_tuple, causing the mlx5 driver to dereference an uninitialized pointer in the error handling path and crash the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit 882f392d9e3649557e71efd78ae20c86039ffb7c or later stable release; disable hardware offload for connection tracking as a temporary mitigation if patching is delayed.

How to confirm the fix worked

Confirm kernel version includes the referenced commit; reproduce error path with synthetic ct_rule_add failures and verify no NULL dereference occurs; monitor for absence of the described BUG in kernel logs.

Typical attack path

1. Establish network flows that engage connection tracking offload on mlx5 hardware
2. Force ct_rule_add to return an error during mlx5_tc_ct_entry_add_rule
3. Trigger uninitialized attr pointer dereference in error cleanup
4. Induce kernel NULL pointer dereference and panic

How to detect it

Inspect kernel logs for BUG: kernel NULL pointer dereference with RIP in mlx5_tc_ct_entry_add_rule and call traces involving nf_flow_offload_tuple or mlx5_tc_ct_block_flow_offload.

• mlx5_tc_ct_entry_add_rule+0x2b1/0x2f0 [mlx5_core]
• BUG: kernel NULL pointer dereference, address: 0000000000000110
• mlx5_tc_ct_block_flow_offload+0xc6a/0xf90 [mlx5_core]

What your security team should do

• Prioritize patching mlx5-enabled systems within standard kernel update cycles
• Review and test connection tracking offload configurations in network-heavy environments
• Monitor kernel logs for similar page_fault_oops patterns involving mlx5_tc_ct