CVE-2024-35854 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2024-35854?

CVE-2024-35854 has a CVSS score of 8.8 (HIGH). A use-after-free vulnerability in the Linux kernel's mlxsw driver allows attackers to potentially execute arbitrary code or crash the system. This affects systems using Mellanox Spectrum switches with the mlxsw driver. The vulnerability occurs during ACL TCAM region rehashing when migration fails but the region is incorrectly destroyed.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's mlxsw driver allows attackers to potentially execute arbitrary code or crash the system. This affects systems using Mellanox Spectrum switches with the mlxsw driver. The vulnerability occurs during ACL TCAM region rehashing when migration fails but the region is incorrectly destroyed.

💻 Affected Systems

Products:

Linux kernel with mlxsw driver
Mellanox Spectrum switches

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Mellanox Spectrum hardware using the mlxsw driver. The vulnerability is triggered during ACL TCAM region rehashing operations.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory corruption leading to arbitrary code execution with kernel privileges, complete system compromise, or persistent denial of service.

🟠

Likely Case

Kernel panic or system crash causing denial of service, potentially requiring physical access to restore functionality.

🟢

If Mitigated

Limited impact if proper kernel hardening is in place, but still risk of system instability.

🌐 Internet-Facing: LOW - Requires local access or ability to execute code on the system.

🏢 Internal Only: MEDIUM - Could be exploited by malicious insiders or through lateral movement from compromised internal systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH - Requires understanding of kernel memory management and ability to trigger specific rehashing conditions.

Exploitation requires local access and ability to manipulate ACL TCAM operations. No public exploits known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 311eeaa7b9e26aba5b3d57b09859f07d8e9fc049, 4c89642ca47fb620914780c7c51d8d1248201121, 54225988889931467a9b55fdbef534079b665519, 813e2ab753a8f8c243a39ede20c2e0adc15f3887, a02687044e124f8ccb427cd3632124a4e1a7d7c1

Vendor Advisory: https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check your distribution's security advisories for backported patches. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable mlxsw driver

linux

Temporarily disable the affected driver if Mellanox hardware is not essential

echo 'blacklist mlxsw_core' >> /etc/modprobe.d/blacklist-mlxsw.conf
rmmod mlxsw_core

Restrict ACL operations

linux

Limit access to users who can modify ACL rules to reduce attack surface

🧯 If You Can't Patch

Implement strict access controls to prevent unauthorized users from executing code on affected systems
Monitor system logs for kernel panics or unusual mlxsw driver activity

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if mlxsw modules are loaded: lsmod | grep mlxsw && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits or check with distribution's security advisory. Confirm mlxsw driver loads without issues.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KASAN reports of use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove
mlxsw driver crash logs

Network Indicators:

Unexpected network disruptions on Mellanox interfaces

SIEM Query:

source="kernel" AND ("KASAN" OR "use-after-free" OR "mlxsw" OR "panic")

📊 Metadata

CVE ID: CVE-2024-35854

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: May 17, 2024

Last Updated: April 7, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35854, you might also want to check these: