Linux kernel mlx5_core eswitch offloads (termination tables): Adding a multi-destination eswitch rule that partially

CVSS 7.8CVE-2022-49025Firmware, BMC & network fabricnet/mlx5e use-after-free reverting termination tablecurated

Impact

Adding a multi-destination eswitch rule that partially fails leaves a stale termination-table pointer, and releasing the rule triggers a use-after-free in the eswitch - the exact subsystem that enforces which VF sees which traffic. Corruption here is a plausible route to host kernel control from a workload that only has network-namespace privilege.

Who can reach it

A local user who can add and delete tc flower rules with CAP_NET_ADMIN - obtainable in an unprivileged user namespace (unshare -Urn), so reachable from inside many container runtimes, not just from host root.

What to do

Upgrade the host kernel to 6.1 or a stable backport (5.4.226, 5.10.158, 5.15.82, 6.0.12). Rolling reboot of the fleet. Interim: disable unprivileged user namespaces (kernel.unprivileged_userns_clone=0 / user.max_user_namespaces=0) where your container runtime does not need them - a sysctl config change, no reboot.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-49025 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2022/CVE-2022-49025.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.