Linux kernel drivers/vdpa/mlx5 (mlx5 vDPA net device): A guest with an assigned mlx5 vDPA net device sends an

CVSS 8.8CVE-2022-48864Kernel, userspace & hypervisorvdpa/mlx5 VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET missing validationcurated

Impact

A guest with an assigned mlx5 vDPA net device sends an unvalidated queue-pair-count control command and panics the host kernel. CVSS scope is Changed - this is a guest breaking out of its own blast radius into the hypervisor. On a multi-tenant node using mlx5 vDPA for accelerated guest networking, one tenant VM takes down every other VM on that host.

Who can reach it

A malicious virtio driver inside a guest VM with an mlx5 vDPA device, or any local process with access to /dev/vhost-vdpa (typically the qemu/kvm group). No host root required.

What to do

Upgrade the host kernel to 5.17, or a stable backport (5.15.29, 5.16.15) or your distro's patched kernel. Kernel upgrade means a rolling reboot of every hypervisor node using mlx5 vDPA, with live migration or workload drain per node. If you cannot reboot soon, stop exposing vDPA devices to untrusted guests - fall back to SR-IOV VFs or software virtio.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-48864 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2022/CVE-2022-48864.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.