CVE-2024-47734

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58

Description A vulnerability in the Linux kernel has been resolved, specifically in the bonding module. The issue was reported by syzbot and involved unnecessary warnings and logs from the bond xdp get xmit slave() function. This occurred when one bond device had xdpdrv and another bond device, unsupported by XDP, had a slave with xdpgeneric that returned XDP TX. To address this, the WARN ON ONCE() was deleted and a ratelimit was added to the netdev err(). The vulnerability can be reproduced by creating specific bond devices and configuring them with xdpdrv and xdpgeneric.

Recommendations To resolve the issue, update to Linux kernel version 6.6.58 or later. As a temporary workaround, consider disabling the bond xdp get xmit slave() function until a patch is available. Restrict access to the vulnerable bonding module to minimize the risk of exploitation. Avoid using the xdpdrv and xdpgeneric objects in the affected bond devices until the issue is resolved.