CVE-2022-48746

net/mlx5e: Fix handling of wrong devices during bond netevent

published June 20, 2024

CVSS
—
EPSS
0%
Percentile
13.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix handling of wrong devices during bond netevent

Current implementation of bond netevent handler only check if

the handled netdev is VF representor and it missing a check if

the VF representor is on the same phys device of the bond handling

the netevent.

Fix by adding the missing check and optimizing the check if

the netdev is VF representor so it will not access uninitialized

private data and crashes.

BUG: kernel NULL pointer dereference, address: 000000000000036c

PGD 0 P4D 0

Oops: 0000 [#1] SMP NOPTI

Workqueue: eth3bond0 bond_mii_monitor [bonding]

RIP: 0010:mlx5e_is_uplink_rep+0xc/0x50 [mlx5_core]

RSP: 0018:ffff88812d69fd60 EFLAGS: 00010282

RAX: 0000000000000000 RBX: ffff8881cf800000 RCX: 0000000000000000

RDX: ffff88812d69fe10 RSI: 000000000000001b RDI: ffff8881cf800880

RBP: ffff8881cf800000 R08: 00000445cabccf2b R09: 0000000000000008

R10: 0000000000000004 R11: 0000000000000008 R12: ffff88812d69fe10

R13: 00000000fffffffe R14: ffff88820c0f9000 R15: 0000000000000000

FS: 0000000000000000(0000) GS:ffff88846fb00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000000000000036c CR3: 0000000103d80006 CR4: 0000000000370ea0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000

DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Call Trace:

mlx5e_eswitch_uplink_rep+0x31/0x40 [mlx5_core]

mlx5e_rep_is_lag_netdev+0x94/0xc0 [mlx5_core]

mlx5e_rep_esw_bond_netevent+0xeb/0x3d0 [mlx5_core]

raw_notifier_call_chain+0x41/0x60

call_netdevice_notifiers_info+0x34/0x80

netdev_lower_state_changed+0x4e/0xa0

bond_mii_monitor+0x56b/0x640 [bonding]

process_one_work+0x1b9/0x390

worker_thread+0x4d/0x3d0

? rescuer_thread+0x350/0x350

kthread+0x124/0x150

? set_kthread_struct+0x40/0x40

ret_from_fork+0x1f/0x30

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00235 · 13.7th percentile
Published
2024-06-20T11:13Z
EPSS history
Timeline
  • 20 JUN 11:13Z
    net/mlx5e: Fix handling of wrong devices during bond netevent
    cvelistv5