CVE-2024-42224: Linux Kernel MDIO List Check Vulnerability

CVE-2024-42224 Overview

CVE-2024-42224 is a vulnerability in the Linux kernel's Distributed Switch Architecture (DSA) driver for Marvell 88E6xxx Ethernet switch chips. The vulnerability exists in the mv88e6xxx_default_mdio_bus() function, which incorrectly checks for empty lists using list_first_entry(). This improper validation can lead to denial of service conditions and potential integrity issues when the MDIO bus list is empty.

Critical Impact

Local attackers with limited privileges can exploit this vulnerability to cause system instability or denial of service on systems utilizing Marvell 88E6xxx Ethernet switch hardware.

Affected Products

• Linux Kernel (multiple versions)
• Systems with Marvell 88E6xxx Ethernet switch hardware
• Network infrastructure devices using DSA with mv88e6xxx driver

Discovery Timeline

• 2024-07-30 - CVE-2024-42224 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-42224

Vulnerability Analysis

This vulnerability stems from an improper check for exceptional conditions (CWE-754) in the Linux kernel's DSA mv88e6xxx driver. The issue was introduced in commit a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO busses"), which added support for multiple MDIO busses but implemented an incorrect empty list check.

The mv88e6xxx_default_mdio_bus() function checks whether the return value of list_first_entry() is non-NULL to guard against the chip->mdios list being empty. However, this check is fundamentally flawed because list_first_entry() is not designed to return NULL for empty lists—it returns a pointer to the container structure regardless of whether the list has entries.

When exploited, this vulnerability requires local access and low privileges. The attacker does not need user interaction to trigger the flaw. The impact primarily affects system availability through potential crashes or instability, with some integrity implications due to improper list handling.

Root Cause

The root cause is the misuse of the Linux kernel linked list API. The list_first_entry() macro uses container_of() to calculate the address of the first entry in a list, which will return a pointer even when the list is empty. This pointer points to invalid memory relative to the list head, leading to undefined behavior when accessed.

The correct approach is to use list_first_entry_or_null(), which properly checks if the list is empty before returning an entry and returns NULL for empty lists. This was flagged by the Smatch static analysis tool, which detected the incorrect API usage pattern.

Attack Vector

This vulnerability requires local access to the system (AV:L) with low attack complexity (AC:L). An attacker needs low privileges (PR:L) to trigger the vulnerable code path, but no user interaction is required. The scope is unchanged, meaning the vulnerability cannot affect resources beyond the vulnerable component.

The attack involves triggering conditions where the mv88e6xxx driver's MDIO bus list is empty during the call to mv88e6xxx_default_mdio_bus(). This can occur during device initialization, driver module operations, or specific network configuration scenarios. When the empty list is dereferenced using the incorrect check, it can lead to kernel crashes or memory corruption.

Detection Methods for CVE-2024-42224

Indicators of Compromise

• Unexpected kernel panics or oops messages referencing the mv88e6xxx driver module
• System instability or crashes during network switch initialization or configuration changes
• Kernel log entries indicating list corruption or invalid memory access in DSA subsystem

Detection Strategies

• Monitor kernel logs for stack traces involving mv88e6xxx_default_mdio_bus() or related DSA functions
• Implement kernel module integrity monitoring to detect exploitation attempts targeting the mv88e6xxx driver
• Use SentinelOne's behavioral analysis to identify anomalous kernel-level activity patterns

Monitoring Recommendations

• Enable kernel crash dump analysis to capture forensic evidence of exploitation attempts
• Deploy runtime kernel protection mechanisms to detect and prevent unauthorized memory access
• Monitor for unusual MDIO bus operations or switch configuration attempts

How to Mitigate CVE-2024-42224

Immediate Actions Required

• Update to a patched Linux kernel version that includes the fix for this vulnerability
• Audit systems using Marvell 88E6xxx Ethernet switch hardware to determine exposure
• Restrict local system access to trusted users only until patches can be applied
• Consider deploying SentinelOne endpoint protection for kernel-level threat detection

Patch Information

The Linux kernel maintainers have released patches across multiple stable branches. The fix replaces the incorrect list_first_entry() check with list_first_entry_or_null(), which properly handles empty lists by returning NULL. Multiple patch commits are available:

• Kernel Git Commit 2a2fe25a
• Kernel Git Commit 3bf8d70e
• Kernel Git Commit 3f25b5f1
• Kernel Git Commit 47d28dde
• Kernel Git Commit 4c7f3950
• Kernel Git Commit 8c2c3cca

Debian LTS users should refer to the Debian LTS Security Announcement for distribution-specific patches.

Workarounds

• If immediate patching is not possible, restrict local system access to minimize attack surface
• Disable or unload the mv88e6xxx kernel module if Marvell 88E6xxx switch functionality is not required
• Monitor systems for signs of exploitation while planning patch deployment

# Check if the vulnerable module is loaded
lsmod | grep mv88e6xxx

# View current kernel version to determine if patching is needed
uname -r

# Check kernel logs for any mv88e6xxx related errors
dmesg | grep -i mv88e6xxx