LiveActive security incident?Get immediate response
CVE Record

CVE-2024-43846: lib: objagg: Fix general protection fault

In the Linux kernel, the following vulnerability has been resolved: lib: objagg: Fix general protection fault The library supports aggregation of objects into other objects only if the parent object does not have a parent itself. That is, nesting is not supported. Aggregation happens in two cases: Without and with hints, where hints are a pre-computed recommendation on how to aggregate the provided objects. Nesting is not possible in the first case due to a check that prevents it, but in the second case there is no check because the assumption is that nesting cannot happen when creating objects based on hints. The violation of this assumption leads to various warnings and eventually to a general protection fault [1]. Before fixing the root cause, error out when nesting happens and warn. [1] general protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G W 6.9.0-rc6-custom-gd9b4f1cca7fb #7 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel object-aggregation flaw can allow unsupported nested objects when precomputed hints are used. This may produce warnings and ultimately crash the kernel with a general protection fault. The documented failure occurred during Mellanox switch ACL processing, potentially disrupting affected networking infrastructure.

Executive priority

Treat this as a high-priority kernel maintenance issue, especially for Mellanox-based switching infrastructure where ACL processing is operationally important. Schedule validated kernel updates promptly. Emergency action is not supported solely by the supplied evidence because active exploitation is unconfirmed and practical reachability beyond the documented workflow remains unclear.

Technical view

The objagg library blocks nested aggregation in its normal path but lacked an equivalent check in the hints-based path. Invalid nesting can corrupt processing and cause a general protection fault. The supplied trace reaches mlxsw ACL TCAM rehash work. CVSS 3.1 rates it 7.8 with local, low-privileged access and high confidentiality, integrity, and availability impacts.

Likely exposure

Exposure requires an affected Linux kernel and a reachable workflow using objagg hint-based aggregation. The supplied failure involved the mlxsw driver and Mellanox switch ACL processing, but the sources do not establish that exposure is limited to that configuration. The bundled version data spans several kernel branches through 6.11; verify distribution backports individually.

Exploitation context

The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. They document warnings and a kernel general protection fault, not a confirmed real-world compromise.

Researcher notes

The security boundary failure is inconsistent validation between ordinary and hint-driven aggregation paths. The remediation rejects and warns on nested aggregation before the invalid state progresses. Researchers should verify branch-specific commit inclusion and investigate reachability from local users without attempting production fault reproduction. No CWE classification is supplied.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable stable fix or distribution backport.
  • Review the referenced Linux stable commits and distribution advisories for the deployed kernel branch.
  • Prioritize affected systems using mlxsw-driven switching and ACL or TCAM rehash operations.
  • Use vendor guidance for temporary risk reduction if immediate kernel replacement is impractical.

Validation and detection

  • Inventory running kernel releases and package versions across Linux systems.
  • Confirm each kernel package includes the relevant stable commit or distribution backport.
  • Review kernel logs for objagg nesting warnings, general protection faults, or the documented mlxsw call trace.
  • Regression-test relevant switch ACL operations after updating, preferably in staging.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-43846 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-43846Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9069a3817d82b01b3a55da382c774e3575946130, 9069a3817d82b01b3a55da382c774e3575946130, 9069a3817d82b01b3a55da382c774e3575946130, 9069a3817d82b01b3a55da382c774e3575946130, 9069a3817d82b01b3a55da382c774e3575946130, 9069a3817d82b01b3a55da382c774e3575946130, 9069a3817d82b01b3a55da382c774e3575946130unaffected
LinuxLinux5.1, 0, 5.4.282, 5.10.224, 5.15.165, 6.1.103, 6.6.44, 6.10.3, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.