Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw in the mlx5 networking driver can trigger a kernel warning during IPsec cleanup in specific RoCE multi-port configurations. Exposure appears limited to systems using mlx5 hardware, IPsec offload, and a slave interface whose master lacks IPsec support. The supplied CVSS score is 7.8, but the documented failure is a warning and call trace.
Executive priority
Prioritize promptly where the specific mlx5, RoCE, and IPsec-offload conditions exist, especially on multi-user systems. Broad emergency action across all Linux assets is not supported by the supplied evidence. First identify configured exposure, then apply supported kernel updates through normal expedited patching processes.
Technical view
The mlx5 driver incorrectly allowed IPsec creation on a slave device when its master lacked IPsec support. During asynchronous XFRM state destruction, mlx5 IPsec RoCE transmit cleanup could enter peer-device locking and trigger a down_read warning. The referenced kernel fixes reject that unsupported creation path. The supplied record identifies Linux kernel versions beginning at 6.7 as affected, with exact fixed boundaries requiring vendor mapping.
Likely exposure
Likely exposure is narrow: Linux hosts using Mellanox/NVIDIA mlx5 networking, RoCE multi-port or master/slave device arrangements, and IPsec hardware offload. Ordinary Linux systems without this hardware and configuration are unlikely to reach the documented path. The source bundle lacks CPEs and distribution-specific package versions, so inventory must be mapped against vendor advisories or kernel commits.
Exploitation context
The CVSS vector describes a local, low-privileged, low-complexity condition requiring no user interaction. However, the supplied sources provide no exploit evidence, and the CVE is not listed as KEV in the bundle. Do not treat active exploitation as established. The narrative demonstrates a kernel warning during cleanup, not a confirmed real-world compromise.
Researcher notes
The source narrative establishes an invalid configuration path and reproducible kernel warning during XFRM garbage collection. It does not explain how the CVSS-assigned confidentiality and integrity impacts arise, nor confirm a crash, privilege escalation, or exploit. Exact affected and fixed distribution versions are absent. Validate ancestry against commits 2ae52a65a850 and 607e1df7bd47 without inferring exploitability from the trace alone.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced mlx5 fixes.
- Check distribution guidance for the exact fixed package applicable to each host.
- Avoid IPsec offload on affected slave configurations until patched, if operationally acceptable.
- Prioritize exposed multi-tenant or untrusted-user systems using the affected mlx5 configuration.
Validation and detection
- Inventory kernel versions, mlx5 hardware, RoCE usage, and IPsec offload configuration.
- Map installed kernel packages to vendor advisories or the referenced stable commits.
- Review kernel logs for down_read warnings involving mlx5_ipsec_fs_roce_tx_destroy.
- Confirm unsupported slave IPsec creation is rejected after updating.
- Retest affected networking workflows without intentionally causing production disruption.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-45017 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2ae52a65a850ded75a94e8d7ec1e09737f4c6509CVE reference, Linux
- https://git.kernel.org/stable/c/607e1df7bd47fe91cab85a97f57870a26d066137CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.