Security readout for executives and security teams
Plain-English summary
A Linux mlx5 network-driver flaw can mishandle a firmware completion during an internal device error, accessing memory after it was freed. This can crash or corrupt the host and, under the supplied CVSS assessment, may affect confidentiality, integrity, and availability. Exploitation requires local access, privileges, and a difficult timing or state condition.
Executive priority
Treat this as a high-priority, targeted kernel update for affected mlx5 systems, especially critical infrastructure. It is not evidenced as an internet-wide or actively exploited emergency. Accelerate inventory and patch verification because successful memory corruption could have severe host impact, while recognizing that local privileges and a difficult trigger reduce immediate likelihood.
Technical view
When mlx5 firmware reports a command completion while the device is in an internal error state, mlx5_core may invoke a completion handler for an entry the command-interface flush also completes, causing reference-count underflow and use-after-free. The stable fix discards firmware completions in this state and lets the command-interface flush trigger completions.
Likely exposure
Exposure is limited to Linux systems using mlx5_core on a vulnerable kernel build. The supplied version list is irregular and mixes releases with commit identifiers, so version strings alone are insufficient. Confirm whether each deployed vendor kernel contains an applicable referenced fix.
Exploitation context
The supplied CVSS 3.1 vector scores this 7.0: local access, low privileges, high complexity, and no user interaction, with potentially high impact. The bundle marks KEV false and provides no evidence of active exploitation or a public exploit. The triggering internal-error and firmware-completion state may constrain practical exploitation.
Researcher notes
The decisive condition is a firmware command completion arriving while mlx5 reports internal error. The fix suppresses that handler because command-interface flushing manually completes outstanding commands. The bundle demonstrates a reference-count underflow and use-after-free but does not establish attacker-controlled memory effects, reliable exploitation, affected hardware models, or distribution-specific backport status.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable stable fix.
- Match vendor kernel builds against the referenced Linux stable commits.
- Prioritize hosts actively using mlx5_core and carrying sensitive or availability-critical workloads.
- Consult distribution guidance where backport status cannot be established from version numbers.
Validation and detection
- Inventory running kernel builds on systems using mlx5_core.
- Confirm each build contains its branch-appropriate referenced stable fix.
- Review kernel logs for refcount underflow, use-after-free, or the supplied mlx5_core call trace.
- Verify patched systems operate normally through controlled device-error recovery testing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-38555 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3CVE reference, Linux
- https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0CVE reference, Linux
- https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396CVE reference, Linux
- https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdbCVE reference, Linux
- https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7CVE reference, Linux
- https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265aCVE reference, Linux
- https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.