CVE-2024-35855 is a use-after-free vulnerability identified in the Linux kernel's mlxsw (Mellanox switch) driver, specifically within the spectrum_acl_tcam component responsible for managing Access Control List (ACL) rules in hardware TCAM (Ternary Content-Addressable Memory). The vulnerability arises during the periodic activity update of ACL rules, where the delayed work task traverses the list of configured rules and queries their activity status from the device. Concurrently, a rehash delayed work can modify the entries, leading to a race condition where the pointer 'ventry->entry' may be freed and replaced while still being accessed. This results in a use-after-free condition, which is a memory safety flaw that can cause kernel crashes or potentially allow attackers to execute arbitrary code or escalate privileges if exploited. The root cause is the lack of proper synchronization between the activity update and rehash operations. The fix implemented involves introducing a mutex lock ('vregion->lock') to serialize access and prevent concurrent modification during the activity query, thereby closing the race condition. The vulnerability was identified through Kernel Address Sanitizer (KASAN) reports indicating slab-use-after-free errors during the execution of the mlxsw_sp_acl_tcam_flower_rule_activity_get function. The affected component is critical in networking hardware using Mellanox Technologies switches, such as the MSN3700 series. The vulnerability affects Linux kernel versions including the 6.9.0-rc2 release candidate and likely other versions incorporating the vulnerable mlxsw driver code. No known exploits are reported in the wild as of the publication date (May 17, 2024). No CVSS score has been assigned yet.

For European organizations, this vulnerability poses a significant risk particularly to enterprises and data centers relying on Linux-based systems with Mellanox networking hardware for high-performance networking and switching. Exploitation could lead to kernel crashes causing denial of service (DoS), impacting availability of critical network infrastructure. More severe exploitation could allow attackers with local access or the ability to trigger the vulnerable code path to execute arbitrary code within the kernel context, potentially leading to privilege escalation and full system compromise. This is especially critical for cloud providers, telecommunications companies, and financial institutions in Europe that depend on stable and secure network operations. The vulnerability undermines the integrity and availability of network ACL enforcement, which could be leveraged to bypass security controls or disrupt traffic filtering. Given the kernel-level nature of the flaw, remediation delays could expose organizations to persistent risks. However, exploitation requires triggering specific kernel driver operations, suggesting that remote exploitation without prior access is less likely, but local or containerized environments with access to the vulnerable driver remain at risk.

European organizations should prioritize updating their Linux kernels to versions that include the patch fixing CVE-2024-35855. Since the patch involves adding mutex locking to prevent race conditions, it is critical to deploy official kernel updates from trusted Linux distributions or Mellanox firmware updates where applicable. Network administrators should audit their infrastructure to identify systems running Mellanox switches with the vulnerable mlxsw driver and schedule maintenance windows for kernel upgrades. In environments where immediate patching is not feasible, organizations should restrict access to systems with Mellanox hardware to trusted users only and monitor kernel logs for suspicious activity or crashes related to mlxsw. Employing kernel hardening techniques such as Kernel Address Sanitizer (KASAN) in testing environments can help detect similar issues proactively. Additionally, organizations should implement strict network segmentation and access controls to limit the ability of unprivileged users or containers to interact with the vulnerable driver code paths. Regular vulnerability scanning and compliance checks should include verification of kernel versions and Mellanox driver updates.