Linux kernel mlx5_core software steering (fs_dr): Adding a flow rule with 32 destinations overflows an undersized

CVE-2022-48932Kernel, userspace & hypervisornet/mlx5 DR slab-out-of-bounds in mlx5_cmd_dr_create_ftecurated

Impact

Adding a flow rule with 32 destinations overflows an undersized action buffer in the software steering path - there was no check on the action count. Multi-destination rules are how you build mirroring and multicast replication in the NIC, so an operator or automation system building a large fan-out rule corrupts kernel slab memory.

Who can reach it

Local with network-configuration privilege (CAP_NET_ADMIN), including inside a user namespace on many setups. Triggered by installing a steering rule with a large destination list.

What to do

Upgrade the host kernel to 5.17 or the 5.16.12 stable backport. Rolling reboot. Interim: cap the number of destinations your SDN controller or CNI is allowed to program per rule.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-48932 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2022/CVE-2022-48932.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.