CVE-2024-36030: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36030 affects the Linux kernel, specifically involving a double free vulnerability in the octeontx2-af driver's rvu_npc_freemem() function. The issue was discovered through Clang static checker analysis and was disclosed in May 2024. The vulnerability affects the Marvell OcteonTX2 network driver implementation in the Linux kernel (Kernel Git).

The vulnerability stems from a redundant memory deallocation attempt in the rvu_npc_freemem() function within the drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c file. Specifically, the function attempts to free mcam->counters.bmap after it has already been released by npc_mcam_rsrcs_deinit(). This double free condition was identified at line 2184, column 2 of the source file. The issue was introduced by commit dd7842878633 which added new devlink parameters for NIX block LF configuration (Kernel Git).

A double free vulnerability can potentially lead to memory corruption and system instability. In some cases, it could be exploited to cause denial of service conditions or potentially lead to arbitrary code execution. The vulnerability affects systems using the Marvell OcteonTX2 network driver (CISA ADP).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, indicating that local access is required for exploitation (CISA ADP).

The vulnerability has been fixed by removing the redundant kfree() call in the rvu_npc_freemem() function. The fix has been merged into the Linux kernel and is available through kernel updates. Users should update their systems to the patched version when available (Kernel Git).