net/mlx5e: Disable softirq in mlx5e_activate_rq to avoid race condition
Summary
GSD-2022-1002973: net/mlx5e: Disable softirq in mlx5e_activate_rq to avoid race condition. Affects Kernel versions >= bc77b240b3c57236cdcc08d64ca390655d3a16ff, < bea6bd8dadb7803a15414539d412cb0cb66f90cd. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The net/mlx5e package is a network driver for Mellanox ConnectX-4 and ConnectX-5 Ethernet adapters. It is responsible for handling network traffic and providing connectivity for these adapters. The mlx5e_activate_rq function is a part of this package and is used to activate a receive queue (RQ) for incoming network packets. This function is vulnerable to a race condition, which can lead to potential security vulnerabilities.
Vulnerability Detail
The vulnerability in mlx5e_activate_rq arises from a race condition that can occur when multiple threads attempt to activate the same receive queue simultaneously. This race condition can result in inconsistent state changes and potential security vulnerabilities. An attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive information or execute arbitrary code on the affected system. The vulnerability was introduced in version v4.7 of the Linux Kernel and is fixed in version v5.17.15.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The net/mlx5e package in the Linux Kernel is vulnerable to a race condition in the mlx5e_activate_rq function. This vulnerability can potentially lead to unauthorized access or arbitrary code execution. It is recommended to update the Linux Kernel to version v5.17.15 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
net/mlx5e is a network driver for Mellanox ConnectX-4 and ConnectX-5 Ethernet adapters.
mlx5e_activate_rq is a function in the net/mlx5e package used to activate a receive queue for incoming network packets.
A race condition is a situation in which the behavior of a program depends on the relative timing of events, such as the execution of multiple threads or processes.
This vulnerability can potentially allow an attacker to gain unauthorized access to sensitive information or execute arbitrary code on the affected system.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.17.15 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
