CVE-2024-35837
📋 TL;DR
This CVE describes a vulnerability in the Linux kernel's Marvell PP2 network driver where buffer manager pool registers retain values after kexec reboots, causing kernel panics. Systems using affected kernel versions with the mvpp2 driver are vulnerable, particularly those utilizing kexec for fast reboots or live kernel updates.
💻 Affected Systems
- Linux kernel with Marvell PP2 network driver (mvpp2)
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to complete system crash and denial of service, requiring physical or remote console access to reboot.
Likely Case
System crash during kexec operations, disrupting services and requiring manual intervention to restore functionality.
If Mitigated
No impact if kexec is not used or if systems are patched before attempting kexec operations.
🎯 Exploit Status
Requires local access and ability to execute kexec. Not a remote code execution vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing commits 83f99138bf3b, 938729484cfa, 9f538b415db8, af47faa6d332, or cec65f09c47d
Vendor Advisory: https://git.kernel.org/stable/c/83f99138bf3b396f761600ab488054396fb5768f
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from distribution vendor. 2. Reboot system to load new kernel. 3. Verify driver functionality after reboot.
🔧 Temporary Workarounds
Disable kexec
linuxPrevent use of kexec system call to avoid triggering the vulnerability
echo 0 > /proc/sys/kernel/kexec_load_disabled
sysctl -w kernel.kexec_load_disabled=1
🧯 If You Can't Patch
- Avoid using kexec functionality on affected systems
- Implement strict access controls to prevent unauthorized users from executing kexec
🔍 How to Verify
Check if Vulnerable:
Check if system uses mvpp2 driver: lsmod | grep mvpp2. Check kernel version against patched versions.Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes fix commits or is newer than vulnerable versions. Test kexec functionality if needed.📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages in /var/log/kern.log or dmesg
- System crash logs mentioning mvpp2 or buffer manager
Network Indicators:
- Sudden loss of network connectivity on mvpp2 interfaces
SIEM Query:
source="kernel" AND ("panic" OR "Oops") AND "mvpp2"🔗 References
- https://git.kernel.org/stable/c/83f99138bf3b396f761600ab488054396fb5768f
- https://git.kernel.org/stable/c/938729484cfa535e9987ed0f86f29a2ae3a8188b
- https://git.kernel.org/stable/c/9f538b415db862e74b8c5d3abbccfc1b2b6caa38
- https://git.kernel.org/stable/c/af47faa6d3328406038b731794e7cf508c71affa
- https://git.kernel.org/stable/c/cec65f09c47d8c2d67f2bcad6cf05c490628d1ec
- https://git.kernel.org/stable/c/dc77f6ab5c3759df60ff87ed24f4d45df0f3b4c4
- https://git.kernel.org/stable/c/83f99138bf3b396f761600ab488054396fb5768f
- https://git.kernel.org/stable/c/938729484cfa535e9987ed0f86f29a2ae3a8188b
- https://git.kernel.org/stable/c/9f538b415db862e74b8c5d3abbccfc1b2b6caa38
- https://git.kernel.org/stable/c/af47faa6d3328406038b731794e7cf508c71affa
- https://git.kernel.org/stable/c/cec65f09c47d8c2d67f2bcad6cf05c490628d1ec
- https://git.kernel.org/stable/c/dc77f6ab5c3759df60ff87ed24f4d45df0f3b4c4
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
