net/mlx5: fs, delete the FTE when there are no rules attached to it
Summary
GSD-2022-1002815: net/mlx5: fs, delete the FTE when there are no rules attached to it. Affects Kernel versions < 150fdfe3355bd9d803d28bb050ca1ed7b517b4bf. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/mlx5 package is a component of the Linux Kernel ecosystem. It provides support for Mellanox ConnectX network adapters, enabling high-performance networking capabilities. The package includes various modules and drivers for managing and configuring the network interface. One of the modules, fs, is responsible for handling flow steering rules and forwarding table entries (FTEs). FTEs are used to match incoming packets against predefined rules and determine their forwarding behavior. This vulnerability specifically affects the fs module when there are no rules attached to an FTE.
Vulnerability Detail
The vulnerability in net/mlx5 fs module allows for the persistence of FTEs even when no rules are attached to them. This can lead to resource wastage and potential performance degradation. Attackers may exploit this vulnerability to exhaust system resources by creating a large number of FTEs without associated rules. This could result in denial of service (DoS) conditions or impact the overall network performance. The vulnerability has been fixed in Linux Kernel version v5.18.3 by commit 150fdfe3355bd9d803d28bb050ca1ed7b517b4bf.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually delete FTEs that have no rules attached to them. This can be achieved by identifying the FTEs without rules and removing them using the appropriate commands or APIs provided by the net/mlx5 package. Here is an example of how to delete FTEs using the mlx5_flow_detach API:
mlx5_flow_detach(dev, fte_id);
Conclusion
In conclusion, the net/mlx5 fs module in the Linux Kernel is vulnerable to the persistence of FTEs without attached rules. This can result in resource wastage, performance degradation, and potential denial of service (DoS) conditions. It is recommended to update the Linux Kernel to version v5.18.3 or later to fix this vulnerability. Alternatively, users can manually delete FTEs without rules as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource wastage and potential performance degradation. It may also be exploited to create denial of service (DoS) conditions or impact network performance.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the vulnerability has been fixed in Linux Kernel version v5.18.3 by commit 150fdfe3355bd9d803d28bb050ca1ed7b517b4bf. It is recommended to update to this version or later to mitigate the vulnerability.
Yes, as a workaround, you can manually delete FTEs that have no rules attached to them. This can be done using the appropriate commands or APIs provided by the net/mlx5 package.
You can refer to the vulnerability details in the GSD Database at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002815.json for more information.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
