CVE-2024-57843

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-57843", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-01-11T12:32:49.621Z", "datePublished": "2025-01-11T14:30:57.255Z", "dateUpdated": "2026-08-05T11:46:39.052Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:39.052Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix overflow inside virtnet_rq_alloc\n\nWhen the frag just got a page, then may lead to regression on VM.\nSpecially if the sysctl net.core.high_order_alloc_disable value is 1,\nthen the frag always get a page when do refill.\n\nWhich could see reliable crashes or scp failure (scp a file 100M in size\nto VM).\n\nThe issue is that the virtnet_rq_dma takes up 16 bytes at the beginning\nof a new frag. When the frag size is larger than PAGE_SIZE,\neverything is fine. However, if the frag is only one page and the\ntotal size of the buffer and virtnet_rq_dma is larger than one page, an\noverflow may occur.\n\nThe commit f9dac92ba908 (\"virtio_ring: enable premapped mode whatever\nuse_dma_api\") introduced this problem. And we reverted some commits to\nfix this in last linux version. Now we try to enable it and fix this\nbug directly.\n\nHere, when the frag size is not enough, we reduce the buffer len to fix\nthis problem."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The overflow is driven entirely by the virtio-net RX refill path: a remote peer sending sustained large/GRO-coalesced traffic saturates `mrg_avg_pkt_len`, making `get_mergeable_buf_len()` return exactly PAGE_SIZE and turning every fresh single-page refill into a 16-byte out-of-bounds DMA. No local access to the guest is needed \u2014 packets merely have to reach the guest's NIC, even if later dropped by the firewall.\nAC:L - Once the target is in a vulnerable configuration (XDP attached, `net.core.high_order_alloc_disable=1`, 64K-page kernel, or ordinary order-3 allocation failure under memory pressure the attacker's own traffic helps induce), the overflow is deterministic and repeats on every fresh page \u2014 the commit describes it as \"reliable crashes\", with no race window or unknown memory layout to win.\nPR:N - The attacker only needs to send network traffic to the guest; the RX refill and EWMA update happen in the driver before any socket, authentication, or firewall decision. No credentials or local account are required.\nUI:N - The condition is created by the packet stream itself as the driver refills the receive queue; no administrator or user action is needed beyond the interface being up.\nS:U - The out-of-bounds DMA write and the over-long skb frag corrupt/expose memory belonging to the same guest kernel that owns the driver; no VM, IOMMU, or sandbox boundary is crossed by the vulnerability itself.\nC:H - The published buffer extends past the order-0 page, so the skb frag covers 16 bytes of an unrelated adjacent page that are copied into the delivered packet and can leak kernel heap contents to userspace or back onto the network, and the accompanying heap corruption can be leveraged for further disclosure.\nI:H - The device is handed an sg entry 16 bytes longer than the DMA mapping, so attacker-supplied packet bytes are written past the page boundary into an adjacent buddy page (or past a swiotlb slot) \u2014 a page-granular out-of-bounds write primitive with controlled data, usable against neighbouring slab objects or page tables.\nA:H - The fix commit states the bug produces \"reliable crashes or scp failure\" on affected VMs, and the corruption of adjacent kernel memory (or IOMMU fault storms) readily panics the guest."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/virtio_net.c"], "versions": [{"version": "295525e29a5b5694a6e96864f0c1365f79639863", "lessThan": "a8f7d6963768b114ec9644ff0148dde4c104e84b", "status": "affected", "versionType": "git"}, {"version": "295525e29a5b5694a6e96864f0c1365f79639863", "lessThan": "67a11de8965c2ab19e215fb6651d44847e068614", "status": "affected", "versionType": "git"}, {"version": "295525e29a5b5694a6e96864f0c1365f79639863", "lessThan": "6aacd1484468361d1d04badfe75f264fa5314864", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/virtio_net.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.66", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.5", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.66"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a8f7d6963768b114ec9644ff0148dde4c104e84b"}, {"url": "https://git.kernel.org/stable/c/67a11de8965c2ab19e215fb6651d44847e068614"}, {"url": "https://git.kernel.org/stable/c/6aacd1484468361d1d04badfe75f264fa5314864"}], "title": "virtio-net: fix overflow inside virtnet_rq_alloc", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/virtio_net.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a8f7d6963768b114ec9644ff0148dde4c104e84b", "status": "affected", "version": "295525e29a5b5694a6e96864f0c1365f79639863", "versionType": "git"}, {"lessThan": "67a11de8965c2ab19e215fb6651d44847e068614", "status": "affected", "version": "295525e29a5b5694a6e96864f0c1365f79639863", "versionType": "git"}, {"lessThan": "6aacd1484468361d1d04badfe75f264fa5314864", "status": "affected", "version": "295525e29a5b5694a6e96864f0c1365f79639863", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/virtio_net.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.66", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "90A079EF-8212-45DF-84FB-C525A64635B0", "versionEndExcluding": "6.6.66", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9501D045-7A94-42CA-8B03-821BE94A65B7", "versionEndExcluding": "6.12.5", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix overflow inside virtnet_rq_alloc\n\nWhen the frag just got a page, then may lead to regression on VM.\nSpecially if the sysctl net.core.high_order_alloc_disable value is 1,\nthen the frag always get a page when do refill.\n\nWhich could see reliable crashes or scp failure (scp a file 100M in size\nto VM).\n\nThe issue is that the virtnet_rq_dma takes up 16 bytes at the beginning\nof a new frag. When the frag size is larger than PAGE_SIZE,\neverything is fine. However, if the frag is only one page and the\ntotal size of the buffer and virtnet_rq_dma is larger than one page, an\noverflow may occur.\n\nThe commit f9dac92ba908 (\"virtio_ring: enable premapped mode whatever\nuse_dma_api\") introduced this problem. And we reverted some commits to\nfix this in last linux version. Now we try to enable it and fix this\nbug directly.\n\nHere, when the frag size is not enough, we reduce the buffer len to fix\nthis problem."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: virtio-net: se corrige el desbordamiento dentro de virtnet_rq_alloc Cuando el fragmento acaba de obtener una p\u00e1gina, puede provocar una regresi\u00f3n en la m\u00e1quina virtual. Especialmente si el valor de sysctl net.core.high_order_alloc_disable es 1, entonces el fragmento siempre obtiene una p\u00e1gina cuando se rellena. Lo que podr\u00eda provocar fallos fiables o fallos de SCP (enviar un archivo de 100 M de tama\u00f1o a la m\u00e1quina virtual). El problema es que virtnet_rq_dma ocupa 16 bytes al principio de un nuevo fragmento. Cuando el tama\u00f1o del fragmento es mayor que PAGE_SIZE, todo est\u00e1 bien. Sin embargo, si el fragmento es solo una p\u00e1gina y el tama\u00f1o total del b\u00fafer y virtnet_rq_dma es mayor que una p\u00e1gina, puede producirse un desbordamiento. El commit f9dac92ba908 (\"virtio_ring: habilitar el modo premapeado sea cual sea el uso de_dma_api\") introdujo este problema. Y revertimos algunas confirmaciones para solucionar este problema en la \u00faltima versi\u00f3n de Linux. Ahora intentamos habilitarlo y solucionar este error directamente. Aqu\u00ed, cuando el tama\u00f1o del fragmento no es suficiente, reducimos la longitud del b\u00fafer para solucionar este problema."}], "id": "CVE-2024-57843", "lastModified": "2026-08-04T11:22:28.730", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-01-11T15:15:07.170", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/67a11de8965c2ab19e215fb6651d44847e068614"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6aacd1484468361d1d04badfe75f264fa5314864"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a8f7d6963768b114ec9644ff0148dde4c104e84b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-191"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2025:6966", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:6966", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}], "bugzilla": {"description": "kernel: virtio-net: fix overflow inside virtnet_rq_alloc", "id": "2337148", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2337148"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-131", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvirtio-net: fix overflow inside virtnet_rq_alloc\nWhen the frag just got a page, then may lead to regression on VM.\nSpecially if the sysctl net.core.high_order_alloc_disable value is 1,\nthen the frag always get a page when do refill.\nWhich could see reliable crashes or scp failure (scp a file 100M in size\nto VM).\nThe issue is that the virtnet_rq_dma takes up 16 bytes at the beginning\nof a new frag. When the frag size is larger than PAGE_SIZE,\neverything is fine. However, if the frag is only one page and the\ntotal size of the buffer and virtnet_rq_dma is larger than one page, an\noverflow may occur.\nThe commit f9dac92ba908 (\"virtio_ring: enable premapped mode whatever\nuse_dma_api\") introduced this problem. And we reverted some commits to\nfix this in last linux version. Now we try to enable it and fix this\nbug directly.\nHere, when the frag size is not enough, we reduce the buffer len to fix\nthis problem."], "name": "CVE-2024-57843", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-01-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-57843\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-57843\nhttps://lore.kernel.org/linux-cve-announce/2025011103-CVE-2024-57843-1c15@gregkh/T"], "threat_severity": "Moderate"}

{}