Null Dereference Vulnerability in net/mlx5e
Summary
GSD-2021-1000599: net/mlx5e: Fix null deref accessing lag dev. Affects Kernel versions >= 7e51891a237f9ea319f53f9beb83afb0077d88e6, < 2e4b0b95a489259f9d35a3db17023061f8f3d587. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/mlx5e package is a network driver for Mellanox ConnectX-4 and ConnectX-5 Ethernet devices. It is a part of the Linux Kernel ecosystem and is responsible for handling network traffic on these devices. The package provides support for various features such as link aggregation (LAG) and virtual LAN (VLAN) tagging.
Vulnerability Detail
The vulnerability identified as GSD-2021-1000599 in net/mlx5e involves a null dereference issue when accessing the LAG (link aggregation) device. This vulnerability was introduced in version v5.8 of the Linux Kernel by commit 7e51891a237f9ea319f53f9beb83afb0077d88e6 and was fixed in version v5.10.42 by commit 2e4b0b95a489259f9d35a3db17023061f8f3d587. A null dereference occurs when a program attempts to access or dereference a null pointer, leading to a crash or potential code execution. In this case, the vulnerability could be triggered by a specific sequence of network operations involving the LAG device, potentially leading to a denial of service (DoS) or privilege escalation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the use of the LAG device or avoid performing network operations that involve the LAG device. This can be achieved by modifying the network configuration or disabling LAG-related features in the network settings.
Conclusion
The null dereference vulnerability in net/mlx5e can be mitigated by updating the Linux Kernel to version v5.10.42 or later. Users can also apply workarounds such as disabling the LAG device or avoiding network operations involving the LAG device. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
net/mlx5e is a network driver for Mellanox ConnectX-4 and ConnectX-5 Ethernet devices in the Linux Kernel.
A null dereference vulnerability occurs when a program attempts to access or dereference a null pointer, leading to a crash or potential code execution.
To fix this vulnerability, update the Linux Kernel to version v5.10.42 or later.
Yes, you can disable the use of the LAG device or avoid performing network operations involving the LAG device.
This vulnerability could lead to a denial of service (DoS) or privilege escalation if exploited.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
