NVIDIA/Mellanox ConnectX flow steering core (mlx5 fs_core FTE active-flag race): Two-phase flow-table-entry deletion

CVSS 7.8CVE-2024-53121NVIDIA / GPU stackcurated

Impact

Two-phase flow-table-entry deletion checks the entry's active flag without holding its lock, so adding a rule with the same match value concurrently with a delete makes fs_core clear the hardware deletion function early and panic on the next removal. The race is between adding and removing rules that match the same traffic - which is what happens when two tenants' network policies touch overlapping match criteria on a shared adapter, so this is reachable by ordinary concurrent activity, not just by a deliberate attacker.

Who can reach it

Local. Concurrent rule add and delete for the same match value on a shared mlx5 adapter, driven by CNI/network-policy churn.

What to do

Kernel update checking the FTE active flag under its lock. No workaround.

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=094d1a2121cee1e85ab07d74388f94809dcfb5b9 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53121.json

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.