CVE-2024-57933: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-57933 is a vulnerability in the Linux kernel that affects the gve (Google Virtual Ethernet) driver's XSK (AF_XDP socket) operations. The vulnerability was discovered and disclosed on January 21, 2025. The issue occurs when XSK operations are performed without properly checking the existence of queues, potentially leading to system crashes when the interface is down (NVD).

The vulnerability is related to the handling of XSK pools in the Linux kernel's gve driver. When the interface is down, disabling or enabling XSK pools could result in a crash due to a NULL RX queue pointer. Additionally, the xsk_wakeup function needed protection against queues disappearing during execution. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and potential high impact on availability (NVD).

If exploited, this vulnerability can cause system crashes when manipulating XSK pools while the interface is down. The primary impact is on system availability, with no direct effect on confidentiality or integrity. The vulnerability specifically affects the Google Virtual Ethernet driver's AF_XDP zero-copy support functionality (NVD).

The vulnerability requires local access and low privileges to exploit. It specifically occurs when attempting to enable or disable XSK pools while the interface is down, or when the xsk_wakeup function is called while queues are disappearing (Kernel Patch).

The vulnerability has been patched in the Linux kernel by adding proper checks for queue existence and interface status. The fix includes guarding XSK operations with netif_running(dev) checks and adding synchronization with the GVE_PRIV_FLAGS_NAPI_ENABLED flag. The patch ensures XSK pool registration occurs only when the interface is up (Kernel Patch).