CVE-2024-35853 – This CVE describes a memory leak vulnerability ... (How to Fix)

Q: What is the severity of CVE-2024-35853?

CVE-2024-35853 has a CVSS score of 6.4 (MEDIUM). This CVE describes a memory leak vulnerability in the Linux kernel's mlxsw driver for Mellanox Spectrum switches. When ACL TCAM region rehashing fails and rollback also fails, the driver attempts another migration that overwrites and leaks memory chunks. This affects systems using Mellanox Spectrum switches with the vulnerable mlxsw driver.

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's mlxsw driver for Mellanox Spectrum switches. When ACL TCAM region rehashing fails and rollback also fails, the driver attempts another migration that overwrites and leaks memory chunks. This affects systems using Mellanox Spectrum switches with the vulnerable mlxsw driver.

💻 Affected Systems

Products:

Linux kernel with mlxsw driver
Mellanox Spectrum switches

Versions: Linux kernel versions before fixes in stable releases (specific commits listed in references)

Operating Systems: Linux

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using Mellanox Spectrum switches with mlxsw driver and ACL TCAM functionality enabled.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Continuous memory leak leading to kernel memory exhaustion, system instability, and potential denial of service or kernel panic.

🟠

Likely Case

Memory leak causing gradual performance degradation and eventual system instability requiring reboot.

🟢

If Mitigated

Minimal impact with proper monitoring and memory limits in place.

🌐 Internet-Facing: LOW - Requires local access to trigger the rehash operation.

🏢 Internal Only: MEDIUM - Could be triggered by network configuration changes or ACL updates on affected switches.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering ACL TCAM region rehash operations, typically through network configuration changes.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel stable releases containing commits: 0ae8ff7b6d42e33943af462910bdcfa2ec0cb8cf, 413a01886c3958d4b8aac23a3bff3d430b92093e, 617e98ba4c50f4547c9eb0946b1cfc26937d70d1, 8ca3f7a7b61393804c46f170743c3b839df13977, b3fd51f684a0711504f82de510da109ae639722d

Vendor Advisory: https://git.kernel.org/stable/c/0ae8ff7b6d42e33943af462910bdcfa2ec0cb8cf

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot system to load new kernel. 3. Verify mlxsw driver is using patched code.

🔧 Temporary Workarounds

Disable ACL TCAM rehashing

linux

Prevent triggering of the vulnerable rehash operation by avoiding ACL configuration changes that would trigger region migration.

# No specific commands - avoid network configuration changes that modify ACL rules

🧯 If You Can't Patch

Monitor kernel memory usage and system logs for memory leak warnings
Implement strict change control for network ACL configurations to minimize rehash triggers

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if mlxsw driver is loaded: 'uname -r' and 'lsmod | grep mlxsw'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and check system logs for absence of parman_destroy warnings

📡 Detection & Monitoring

Log Indicators:

Kernel warnings containing 'parman_destroy'
Memory leak warnings in kernel logs
System instability or OOM killer events

Network Indicators:

None - this is a local memory management issue

SIEM Query:

source="kernel" AND "parman_destroy" OR "mlxsw_sp_acl_tcam_vregion_rehash_work"

📊 Metadata

CVE ID: CVE-2024-35853

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

CWE: CWE-401

Published: May 17, 2024

Last Updated: April 7, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35853, you might also want to check these: