CVE-2024-53138

A flaw was found in the Linux kernel's Mellanox mlx5 network driver. During kernel Transport Layer Security (kTLS) data transmission, an inconsistency in how memory page reference counters are tracked causes large memory structures to be dereferenced excessively when released. A local user could trigger this flaw to cause memory corruption, leading to a system crash and a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable TLS hardware transmit offload on affected Mellanox network interfaces, or prevent the mlx5_core kernel module from loading if Mellanox hardware is not needed.

1. To disable TLS hardware transmit offload on an active network interface:

# ethtool -K <interface_name> tls-hw-tx-offload off

Caveat: Disabling hardware TLS offload shifts TLS encryption and framing processing to the CPU in software, which may increase CPU utilization.

2. Alternatively, if Mellanox ConnectX adapters are not required on the system, prevent the driver module from autoloading by configuring modprobe:

# echo "install mlx5_core /bin/true" > /etc/modprobe.d/disable-mlx5_core.conf

Warning: A system reboot or manual unloading of the module is required for module blacklisting to take effect. Blacklisting mlx5_core will disable all Mellanox network interfaces managed by this driver.