Critical Vulnerability in Linux Kernel: E-Switch Device Compatibility Issue
Summary
CVE-2022-49333: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch, pair only capable devices OFFLOADS paring using devcom is possible only on devices that support LAG. Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of devices and functionalities, including networking capabilities. The specific vulnerability pertains to the Mellanox mlx5 driver, which is responsible for managing network devices that support Link Aggregation Group (LAG) functionalities. This vulnerability can lead to improper handling of device compatibility checks, potentially causing system instability or security breaches.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the Mellanox mlx5 driver related to E-Switch device compatibility. The issue arises when the function mlx5_get_next_phys_dev() is called without holding the necessary interface lock, which can lead to race conditions and undefined behavior. This vulnerability was introduced with the commit that aimed to filter out non-compatible devices based on their LAG capabilities. The lack of proper locking mechanisms can result in system crashes or exploitation by malicious actors, making it critical to address this issue promptly.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, it is advisable to avoid using the affected functionalities until the patch is applied.
Conclusion
The vulnerability CVE-2022-49333 in the Linux kernel's Mellanox mlx5 driver poses significant risks related to device compatibility checks. It is crucial to apply the available patch to safeguard your system against potential exploits. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49333 is a vulnerability in the Linux kernel's Mellanox mlx5 driver that affects device compatibility checks, potentially leading to system instability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The risks include potential system crashes, undefined behavior, and exploitation by malicious actors, which can compromise system security.
Yes, a patch is available in version 5.18.5-1 of the Linux package. It is recommended to update to this version or later.
If immediate updates are not possible, consider limiting the use of affected functionalities and monitoring for any unusual system behavior.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
