net/mlx5: E-Switch, pair only capable devices
Summary
GSD-2022-1002579: net/mlx5: E-Switch, pair only capable devices. Affects Kernel versions >= dd3fddb82780bfa24124834edd90bbc63bd689cc, < cdbcdddb8076a09aa6ddaf20fd911fc787dca0e5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/mlx5 package is a component of the Linux Kernel ecosystem. It provides support for Mellanox ConnectX-4 and ConnectX-5 network adapters, which are used in high-performance computing and data center environments. These adapters are capable of implementing E-Switch functionality, which allows for virtualization and partitioning of network resources. However, certain devices that support E-Switch may have a vulnerability related to pair-only capability.
Vulnerability Detail
The vulnerability in net/mlx5 affects devices that are pair-only capable. This vulnerability was introduced in Linux Kernel version 5.14 and fixed in version 5.18.4. The impact and attack plausibility of this vulnerability have not been proven yet. Further details can be found in the provided references.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The net/mlx5 package in the Linux Kernel has a vulnerability related to pair-only capable devices. It is recommended to update the Linux Kernel to version 5.18.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
net/mlx5 is a package in the Linux Kernel ecosystem that provides support for Mellanox ConnectX-4 and ConnectX-5 network adapters.
E-Switch functionality allows for virtualization and partitioning of network resources in devices that support it.
Devices that are pair-only capable and use the net/mlx5 package in Linux Kernel versions 5.14 to 5.18.3 are affected.
The impact of this vulnerability is currently unknown as it has not been proven yet.
To fix this vulnerability, update the Linux Kernel to version 5.18.4 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
