CVE-2024-57843 (GCVE-0-2024-57843)

Vulnerability from cvelistv5 – Published: 2025-01-11 14:30 – Updated: 2026-08-05 11:46
VLAI
Title
virtio-net: fix overflow inside virtnet_rq_alloc
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix overflow inside virtnet_rq_alloc When the frag just got a page, then may lead to regression on VM. Specially if the sysctl net.core.high_order_alloc_disable value is 1, then the frag always get a page when do refill. Which could see reliable crashes or scp failure (scp a file 100M in size to VM). The issue is that the virtnet_rq_dma takes up 16 bytes at the beginning of a new frag. When the frag size is larger than PAGE_SIZE, everything is fine. However, if the frag is only one page and the total size of the buffer and virtnet_rq_dma is larger than one page, an overflow may occur. The commit f9dac92ba908 ("virtio_ring: enable premapped mode whatever use_dma_api") introduced this problem. And we reverted some commits to fix this in last linux version. Now we try to enable it and fix this bug directly. Here, when the frag size is not enough, we reduce the buffer len to fix this problem.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 295525e29a5b5694a6e96864f0c1365f79639863 , < a8f7d6963768b114ec9644ff0148dde4c104e84b (git)
Affected: 295525e29a5b5694a6e96864f0c1365f79639863 , < 67a11de8965c2ab19e215fb6651d44847e068614 (git)
Affected: 295525e29a5b5694a6e96864f0c1365f79639863 , < 6aacd1484468361d1d04badfe75f264fa5314864 (git)
Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.66 , ≤ 6.6.* (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a8f7d6963768b114ec9644ff0148dde4c104e84b",
              "status": "affected",
              "version": "295525e29a5b5694a6e96864f0c1365f79639863",
              "versionType": "git"
            },
            {
              "lessThan": "67a11de8965c2ab19e215fb6651d44847e068614",
              "status": "affected",
              "version": "295525e29a5b5694a6e96864f0c1365f79639863",
              "versionType": "git"
            },
            {
              "lessThan": "6aacd1484468361d1d04badfe75f264fa5314864",
              "status": "affected",
              "version": "295525e29a5b5694a6e96864f0c1365f79639863",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix overflow inside virtnet_rq_alloc\n\nWhen the frag just got a page, then may lead to regression on VM.\nSpecially if the sysctl net.core.high_order_alloc_disable value is 1,\nthen the frag always get a page when do refill.\n\nWhich could see reliable crashes or scp failure (scp a file 100M in size\nto VM).\n\nThe issue is that the virtnet_rq_dma takes up 16 bytes at the beginning\nof a new frag. When the frag size is larger than PAGE_SIZE,\neverything is fine. However, if the frag is only one page and the\ntotal size of the buffer and virtnet_rq_dma is larger than one page, an\noverflow may occur.\n\nThe commit f9dac92ba908 (\"virtio_ring: enable premapped mode whatever\nuse_dma_api\") introduced this problem. And we reverted some commits to\nfix this in last linux version. Now we try to enable it and fix this\nbug directly.\n\nHere, when the frag size is not enough, we reduce the buffer len to fix\nthis problem."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The overflow is driven entirely by the virtio-net RX refill path: a remote peer sending sustained large/GRO-coalesced traffic saturates `mrg_avg_pkt_len`, making `get_mergeable_buf_len()` return exactly PAGE_SIZE and turning every fresh single-page refill into a 16-byte out-of-bounds DMA. No local access to the guest is needed \u2014 packets merely have to reach the guest\u0027s NIC, even if later dropped by the firewall.\nAC:L - Once the target is in a vulnerable configuration (XDP attached, `net.core.high_order_alloc_disable=1`, 64K-page kernel, or ordinary order-3 allocation failure under memory pressure the attacker\u0027s own traffic helps induce), the overflow is deterministic and repeats on every fresh page \u2014 the commit describes it as \"reliable crashes\", with no race window or unknown memory layout to win.\nPR:N - The attacker only needs to send network traffic to the guest; the RX refill and EWMA update happen in the driver before any socket, authentication, or firewall decision. No credentials or local account are required.\nUI:N - The condition is created by the packet stream itself as the driver refills the receive queue; no administrator or user action is needed beyond the interface being up.\nS:U - The out-of-bounds DMA write and the over-long skb frag corrupt/expose memory belonging to the same guest kernel that owns the driver; no VM, IOMMU, or sandbox boundary is crossed by the vulnerability itself.\nC:H - The published buffer extends past the order-0 page, so the skb frag covers 16 bytes of an unrelated adjacent page that are copied into the delivered packet and can leak kernel heap contents to userspace or back onto the network, and the accompanying heap corruption can be leveraged for further disclosure.\nI:H - The device is handed an sg entry 16 bytes longer than the DMA mapping, so attacker-supplied packet bytes are written past the page boundary into an adjacent buddy page (or past a swiotlb slot) \u2014 a page-granular out-of-bounds write primitive with controlled data, usable against neighbouring slab objects or page tables.\nA:H - The fix commit states the bug produces \"reliable crashes or scp failure\" on affected VMs, and the corruption of adjacent kernel memory (or IOMMU fault storms) readily panics the guest."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:39.052Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a8f7d6963768b114ec9644ff0148dde4c104e84b"
        },
        {
          "url": "https://git.kernel.org/stable/c/67a11de8965c2ab19e215fb6651d44847e068614"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aacd1484468361d1d04badfe75f264fa5314864"
        }
      ],
      "title": "virtio-net: fix overflow inside virtnet_rq_alloc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57843",
    "datePublished": "2025-01-11T14:30:57.255Z",
    "dateReserved": "2025-01-11T12:32:49.621Z",
    "dateUpdated": "2026-08-05T11:46:39.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-57843",
      "date": "2026-08-16",
      "epss": "0.00414",
      "percentile": "0.34559"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvirtio-net: fix overflow inside virtnet_rq_alloc\\n\\nWhen the frag just got a page, then may lead to regression on VM.\\nSpecially if the sysctl net.core.high_order_alloc_disable value is 1,\\nthen the frag always get a page when do refill.\\n\\nWhich could see reliable crashes or scp failure (scp a file 100M in size\\nto VM).\\n\\nThe issue is that the virtnet_rq_dma takes up 16 bytes at the beginning\\nof a new frag. When the frag size is larger than PAGE_SIZE,\\neverything is fine. However, if the frag is only one page and the\\ntotal size of the buffer and virtnet_rq_dma is larger than one page, an\\noverflow may occur.\\n\\nThe commit f9dac92ba908 (\\\"virtio_ring: enable premapped mode whatever\\nuse_dma_api\\\") introduced this problem. And we reverted some commits to\\nfix this in last linux version. Now we try to enable it and fix this\\nbug directly.\\n\\nHere, when the frag size is not enough, we reduce the buffer len to fix\\nthis problem.\"}]",
      "id": "CVE-2024-57843",
      "lastModified": "2025-01-11T15:15:07.170",
      "published": "2025-01-11T15:15:07.170",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/67a11de8965c2ab19e215fb6651d44847e068614\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/6aacd1484468361d1d04badfe75f264fa5314864\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a8f7d6963768b114ec9644ff0148dde4c104e84b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Received"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:12:45.000Z",
      "cve": "CVE-2024-57843",
      "id": "msrc_CVE-2024-57843",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "virtio-net: fix overflow inside virtnet_rq_alloc",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-57843.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-57843\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-11T15:15:07.170\",\"lastModified\":\"2026-08-04T11:22:28.730\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvirtio-net: fix overflow inside virtnet_rq_alloc\\n\\nWhen the frag just got a page, then may lead to regression on VM.\\nSpecially if the sysctl net.core.high_order_alloc_disable value is 1,\\nthen the frag always get a page when do refill.\\n\\nWhich could see reliable crashes or scp failure (scp a file 100M in size\\nto VM).\\n\\nThe issue is that the virtnet_rq_dma takes up 16 bytes at the beginning\\nof a new frag. When the frag size is larger than PAGE_SIZE,\\neverything is fine. However, if the frag is only one page and the\\ntotal size of the buffer and virtnet_rq_dma is larger than one page, an\\noverflow may occur.\\n\\nThe commit f9dac92ba908 (\\\"virtio_ring: enable premapped mode whatever\\nuse_dma_api\\\") introduced this problem. And we reverted some commits to\\nfix this in last linux version. Now we try to enable it and fix this\\nbug directly.\\n\\nHere, when the frag size is not enough, we reduce the buffer len to fix\\nthis problem.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: virtio-net: se corrige el desbordamiento dentro de virtnet_rq_alloc Cuando el fragmento acaba de obtener una p\u00e1gina, puede provocar una regresi\u00f3n en la m\u00e1quina virtual. Especialmente si el valor de sysctl net.core.high_order_alloc_disable es 1, entonces el fragmento siempre obtiene una p\u00e1gina cuando se rellena. Lo que podr\u00eda provocar fallos fiables o fallos de SCP (enviar un archivo de 100 M de tama\u00f1o a la m\u00e1quina virtual). El problema es que virtnet_rq_dma ocupa 16 bytes al principio de un nuevo fragmento. Cuando el tama\u00f1o del fragmento es mayor que PAGE_SIZE, todo est\u00e1 bien. Sin embargo, si el fragmento es solo una p\u00e1gina y el tama\u00f1o total del b\u00fafer y virtnet_rq_dma es mayor que una p\u00e1gina, puede producirse un desbordamiento. El commit f9dac92ba908 (\\\"virtio_ring: habilitar el modo premapeado sea cual sea el uso de_dma_api\\\") introdujo este problema. Y revertimos algunas confirmaciones para solucionar este problema en la \u00faltima versi\u00f3n de Linux. Ahora intentamos habilitarlo y solucionar este error directamente. Aqu\u00ed, cuando el tama\u00f1o del fragmento no es suficiente, reducimos la longitud del b\u00fafer para solucionar este problema.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/virtio_net.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"295525e29a5b5694a6e96864f0c1365f79639863\",\"lessThan\":\"a8f7d6963768b114ec9644ff0148dde4c104e84b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"295525e29a5b5694a6e96864f0c1365f79639863\",\"lessThan\":\"67a11de8965c2ab19e215fb6651d44847e068614\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"295525e29a5b5694a6e96864f0c1365f79639863\",\"lessThan\":\"6aacd1484468361d1d04badfe75f264fa5314864\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/virtio_net.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.66\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.5\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-191\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.6.66\",\"matchCriteriaId\":\"90A079EF-8212-45DF-84FB-C525A64635B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"9501D045-7A94-42CA-8B03-821BE94A65B7\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/67a11de8965c2ab19e215fb6651d44847e068614\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6aacd1484468361d1d04badfe75f264fa5314864\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a8f7d6963768b114ec9644ff0148dde4c104e84b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:12:19+00:00",
      "cve": "CVE-2024-57843",
      "id": "CVE-2024-57843",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: virtio-net: fix overflow inside virtnet_rq_alloc",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-57843.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-31T01:23:39Z",
      "cve": "CVE-2024-57843",
      "id": "CVE-2024-57843",
      "initial_release_date": "2025-01-12T00:13:59Z",
      "product_status:known_not_affected": "453",
      "product_status:recommended": "43",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-57843",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-57843.json",
      "version": "19"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.