net/mlx5e: Incorrect Header Index Calculation in HW_GRO
Summary
GSD-2022-1000641: net/mlx5e: Fix wrong calculation of header index in HW_GRO. Affects Kernel versions >= f97d5c2a453e26071e3b0ec12161de57c4a237c4, < 66c6dbfc8493fc1b0192f74c12d417d911ee632b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/mlx5e package is a network driver for Mellanox ConnectX-4 and ConnectX-5 Ethernet adapters. It provides support for various features and optimizations, including hardware generic receive offload (HW_GRO) for improved packet processing efficiency. HW_GRO allows the driver to offload the processing of multiple packets with similar headers to the hardware, reducing CPU overhead. However, a vulnerability has been identified in the net/mlx5e package that leads to incorrect calculation of the header index in HW_GRO.
Vulnerability Detail
The vulnerability in net/mlx5e arises from a miscalculation of the header index in the HW_GRO feature. This miscalculation can result in incorrect processing of packets with similar headers, leading to potential packet corruption or other network-related issues. An attacker may be able to exploit this vulnerability to cause a denial-of-service (DoS) condition or potentially execute arbitrary code in the context of the affected network driver.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.16.6 or later. This update includes the necessary patch to correct the header index calculation in net/mlx5e. Users can obtain the updated kernel from the official Linux Kernel repository or their respective Linux distribution's package manager.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The net/mlx5e package in the Linux Kernel is vulnerable to incorrect header index calculation in HW_GRO. This vulnerability can lead to packet corruption, network-related issues, and potential exploitation by attackers. It is crucial to update the Linux Kernel to version v5.16.6 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
net/mlx5e is a network driver for Mellanox ConnectX-4 and ConnectX-5 Ethernet adapters, providing support for various features and optimizations.
HW_GRO is a hardware generic receive offload feature that allows the driver to offload the processing of multiple packets with similar headers to the hardware, reducing CPU overhead.
The vulnerability can result in incorrect processing of packets with similar headers, potentially leading to packet corruption or other network-related issues. It may also allow an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code in the context of the affected network driver.
To fix this vulnerability, update the Linux Kernel to version v5.16.6 or later, which includes the necessary patch to correct the header index calculation in net/mlx5e.
Users can obtain the updated kernel from the official Linux Kernel repository or their respective Linux distribution's package manager.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.