CVE-2022-49134

mlxsw: spectrum: Guard against invalid local ports

Medium · published February 26, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum: Guard against invalid local ports

When processing events generated by the device's firmware, the driver

protects itself from events reported for non-existent local ports, but

not for the CPU port (local port 0), which exists, but does not have all

the fields as any local port.

This can result in a NULL pointer dereference when trying access

'struct mlxsw_sp_port' fields which are not initialized for CPU port.

Commit 63b08b1f6834 ("mlxsw: spectrum: Protect driver from buggy firmware")

already handled such issue by bailing early when processing a PUDE event

reported for the CPU port.

Generalize the approach by moving the check to a common function and

making use of it in all relevant places.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00234 · 13.5th percentile
Published
2025-02-26T01:55Z
EPSS history
Timeline
  • 26 FEB 01:55Z
    mlxsw: spectrum: Guard against invalid local ports
    cvelistv5