CVE-2024-53120

A flaw was found in the Linux kernel's Mellanox mlx5 network driver. An uninitialized pointer is improperly accessed within the driver's error-handling path when adding connection tracking rules. A local user can exploit this vulnerability during a rule configuration failure, triggering a null pointer dereference that causes a system crash and Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the mlx5_core kernel module from loading if Mellanox ConnectX devices are not required on the host:

1. Create a configuration file to blacklist the driver:

echo "blacklist mlx5_core" > /etc/modprobe.d/disable-mlx5_core.conf

echo "install mlx5_core /bin/true" >> /etc/modprobe.d/disable-mlx5_core.conf

2. If the module is loaded in the initial ramdisk, regenerate it:

dracut -f

3. Reboot the system for the configuration to take effect.

Caveat: Disabling the mlx5_core module disables all hardware support for Mellanox ConnectX network adapters and disrupts network connectivity on those interfaces. A host reboot is required to ensure the module is fully unloaded.