net/mlx5e: Fix page reclaim for dead peer hairpin in Kernel
Summary
GSD-2021-1001060: net/mlx5e: Fix page reclaim for dead peer hairpin. Affects Kernel versions >= 4d8fcf216c90bc25e34ae2200aa8985ee3158898, < b374c1304f6d3d4752ad1412427b7bf02bb1fd61. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It manages system resources, including memory, processes, and input/output operations. The net/mlx5e module is responsible for handling network traffic for Mellanox ConnectX-4 and ConnectX-5 Ethernet adapters. It enables high-performance networking capabilities and supports various features such as offloading, tunneling, and virtualization. However, a vulnerability has been identified in the net/mlx5e module that affects the page reclaim mechanism for dead peer hairpin connections.
Vulnerability Detail
The vulnerability in the net/mlx5e module allows an attacker to exploit a flaw in the page reclaim mechanism for dead peer hairpin connections. This could lead to memory corruption or a denial-of-service condition. The issue was introduced in version 4.19 of the Linux Kernel and has been fixed in version 5.12.13. The vulnerability has not been proven to have a significant impact or be easily exploitable, but it is important to apply the fix to ensure system security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The net/mlx5e module in the Linux Kernel is vulnerable to a page reclaim issue for dead peer hairpin connections. To mitigate this vulnerability, it is recommended to update the Kernel to version 5.12.13 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/mlx5e module is a component of the Linux Kernel that handles network traffic for Mellanox ConnectX-4 and ConnectX-5 Ethernet adapters.
The vulnerability could lead to memory corruption or a denial-of-service condition.
To fix the vulnerability, update the Linux Kernel to version 5.12.13 or later.
The exploitability of this vulnerability has not been proven, but it is important to apply the fix to ensure system security.
For more information, refer to the vulnerability details in the Open Source Vulnerability format or the provided references link.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
