Linux kernel mlx5_core RX datapath (SHAMPO): SHAMPO can deliver completion entries with zero consumed strides

Impact

SHAMPO can deliver completion entries with zero consumed strides for a work queue entry that was already fully consumed and unlinked, causing a second unlink that corrupts the receive work queue linked list. Remote, unauthenticated corruption of RX ring state on the host NIC - the node's networking dies and the kernel is in an inconsistent state.

Who can reach it

Unauthenticated remote sender of network traffic to an mlx5 host with SHAMPO/HW-GRO active.

What to do

Upgrade the host kernel to 6.11 or a stable backport (6.1.105, 6.6.46, 6.10.5). Rolling reboot fleet-wide. Same interim mitigation as the other SHAMPO bugs: turn off rx-gro-hw via ethtool, a live config change.

References

Related entries

• Linux kernel mlx5_core RX datapath (SHAMPO / HW-GRO): A remote sender can make the mlx5 receive path release a SHAMPOCVE-2024-46717 · Linux kernel mlx5_core RX datapath (SHAMPO / HW-GRO)Critical
• Linux kernel SMC-R/SMC-D (CLC proposal parsing, smcd_v2_ext_offset): The SMC server trusted an offset field takenCVE-2024-47408 · Linux kernel SMC-R/SMC-D (CLC proposal parsing, smcd_v2_ext_offset)Critical
• Linux kernel RTRS client (rtrs-clt init_conns connection-id bound): When connection setup fails partway through, theCVE-2024-47695 · Linux kernel RTRS client (rtrs-clt init_conns connection-id bound)Critical
• Linux kernel SMC-R/SMC-D (CLC proposal parsing, v2_ext_offset / eid_cnt / ism_gid_cnt): The same unvalidated-offsetCVE-2024-49568 · Linux kernel SMC-R/SMC-D (CLC proposal parsing, v2_ext_offset / eid_cnt / ism_gid_cnt)Critical
• Linux kernel mlx5_core kTLS TX offload: The kTLS TX path mixes get_page() and page_ref_inc() when acquiring referencesCVE-2024-53138 · Linux kernel mlx5_core kTLS TX offloadCritical
• Linux kernel (net/smc): The server-side listen worker frees a connection outside the socket lock, so smc_conn_free()CVE-2024-56640 · Linux kernel (net/smc)Critical