Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/en/rep): The neighbour-update worker takes a reference on an

CVSS 7.8CVE-2021-47247Firmware, BMC & network fabriccurated

Impact

The neighbour-update worker takes a reference on an encapsulation entry that a concurrent TC filter update is already freeing. KASAN reports a use-after-free while the worker is deciding which hardware encap rule to reprogram, so freed memory influences the steering state of the shared eswitch and the node crashes.

Who can reach it

Two concurrent drivers are needed and both are cheap to supply: neighbour (ARP/ND) churn from a host on the fabric - including a tenant VM with an address on the same segment - and concurrent TC filter add/delete from the host's offload agent. Requires switchdev/eswitch mode with tunnel-encap TC offload, the standard configuration for OVS hardware offload on a multi-tenant node.

What to do

Update to a patched kernel on your stream. Interim: disable hw-tc-offload on the mlx5 uplink or stop offloading tunnel-encap rules, and keep untrusted tenants off the L2 segment that feeds neighbour updates.

References

https://git.kernel.org/stable/c/0d1e7a7964ce6abb28883a3906bbc20fe0009f03 https://git.kernel.org/stable/c/b6447b72aca571632e71bb73a797118d5ce46a93 https://nvd.nist.gov/vuln/detail/CVE-2021-47247

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.