Critical Vulnerability in Linux Kernel: Peer Flow List Handling Issue
Summary
DEBIAN-CVE-2023-52487: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix peer flow lists handling The cited change refactored mlx5e_tc_del_fdb_peer_flow() to only clear DUP flag when list of peer flows has beco... Affects linux versions < 6.6.15-1. Fixed in 6.6.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and flexibility, making it a popular choice for servers, desktops, and embedded systems. However, vulnerabilities can arise, impacting the security and functionality of systems relying on it. The specific vulnerability in question affects the handling of peer flow lists in the mlx5e networking driver, which can lead to potential system instability and security risks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mlx5e networking driver related to the handling of peer flow lists. The issue arises when the function mlx5e_tc_del_fdb_peer_flow() fails to properly clear the DUP flag if a concurrent user holds a reference to a peer flow. This can lead to a NULL pointer dereference or warnings when attempting to remove flows that were never initialized. The vulnerability can potentially allow for system crashes or erratic behavior, particularly in environments with high concurrency.
How To Fix
Minimum fixed version
6.6.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider limiting concurrent access to the peer flow lists or monitoring the system for any irregularities until the patch can be applied. However, this is not a permanent solution and updating the kernel is strongly recommended.
Conclusion
The vulnerability in the Linux kernel's mlx5e networking driver poses significant risks related to system stability and security. Users are advised to promptly update to the patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or erratic behavior due to improper handling of peer flow lists in the mlx5e driver.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Yes, a patch is available in version 6.6.15-1 of the Linux kernel. Users should update to this version or later.
If an immediate update is not possible, consider limiting concurrent access to the peer flow lists and monitoring the system for any irregularities.
More information can be found in the official Debian CVE database and the Linux kernel documentation related to the mlx5e driver.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
