Linux kernel mlx5_core software steering (fs_dr): Adding a flow rule with 32 destinations overflows an undersized

Impact

Adding a flow rule with 32 destinations overflows an undersized action buffer in the software steering path - there was no check on the action count. Multi-destination rules are how you build mirroring and multicast replication in the NIC, so an operator or automation system building a large fan-out rule corrupts kernel slab memory.

Who can reach it

Local with network-configuration privilege (CAP_NET_ADMIN), including inside a user namespace on many setups. Triggered by installing a steering rule with a large destination list.

What to do

Upgrade the host kernel to 5.17 or the 5.16.12 stable backport. Rolling reboot. Interim: cap the number of destinations your SDN controller or CNI is allowed to program per rule.

References

Related entries

• Linux kernel (drivers/gpu/drm): The shared shmem GEM mmap helper dropped a reference it never owned, so the bufferCVE-2022-48981 · Linux kernel (drivers/gpu/drm)High
• Linux kernel (drivers/gpu/drm/i915/gem): The access handler for a memory-mapped GEM object never bounds-checks theCVE-2022-49261 · Linux kernel (drivers/gpu/drm/i915/gem)High
• Linux kernel (drivers/iommu/arm/arm-smmu-v3): The SMMUv3 SVA path released the pinned ASID without holding a referenceCVE-2022-49426 · Linux kernel (drivers/iommu/arm/arm-smmu-v3)High
• Linux kernel (arch/x86/kvm/mmu): When guest memory is backed by a VM_PFNMAP mapping, KVM derived the target page frameCVE-2022-49562 · Linux kernel (arch/x86/kvm/mmu)High
• Linux kernel (drivers/gpu/drm/i915/gt): The GPU migration copy path used plain ints for sizes that a tenant controlsCVE-2022-49963 · Linux kernel (drivers/gpu/drm/i915/gt)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A double free in the amdkfd (KFD compute driverCVE-2022-50303 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High