Vulnerability in IB/mlx5: Fix initializing CQ fragments buffer
Summary
GSD-2021-1001042: IB/mlx5: Fix initializing CQ fragments buffer. Affects Kernel versions >= 388ca8be00370db132464e27f745b8a0add19fcb, < 3e670c54eda238cb8a1ea93538a79ae89285c1c4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The IB/mlx5 package is a component of the Linux Kernel that provides support for InfiniBand and RoCE (RDMA over Converged Ethernet) network adapters. It includes drivers and utilities for Mellanox ConnectX series network cards. These network adapters are commonly used in high-performance computing and data center environments. The vulnerability in IB/mlx5 relates to the improper initialization of the Completion Queue (CQ) fragments buffer.
Vulnerability Detail
The vulnerability in IB/mlx5 arises from a flaw in the initialization process of the CQ fragments buffer. This flaw can potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition. By sending specially crafted network packets, an attacker may trigger a buffer overflow or other memory corruption issues, leading to the compromise of the affected system. The vulnerability was introduced in version v4.17 of the Linux Kernel and has been fixed in version v5.12.11.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected network adapter or block incoming network traffic on the affected ports. This can help mitigate the risk of exploitation until the kernel is updated to a fixed version. However, this workaround may result in the loss of network connectivity or reduced performance.
Conclusion
The vulnerability in IB/mlx5 related to the improper initialization of the CQ fragments buffer can pose a significant security risk to systems utilizing InfiniBand and RoCE network adapters. It is crucial to update the Linux Kernel to version v5.12.11 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
IB/mlx5 is a component of the Linux Kernel that provides support for InfiniBand and RoCE network adapters, specifically those manufactured by Mellanox.
The vulnerability in IB/mlx5 can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition on the affected system.
To fix the vulnerability, it is recommended to update the Linux Kernel to version v5.12.11 or later.
As a temporary workaround, users can disable the affected network adapter or block incoming network traffic on the affected ports.
To check if your system is affected by this vulnerability, you can use the Vulert Playground (https://vulert.com/scanner) by uploading your package-lock.json file.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
