net/mlx5e: CT, Fix multiple allocations and memleak of mod acts
Summary
UVI-2021-1002318: net/mlx5e: CT, Fix multiple allocations and memleak of mod acts. Affects Kernel versions >= 1ef3018f5af3da6376fae546e4dfc3f05f063815, < 486e8de6e233ff2999493533c6259d1cb538653b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/mlx5e package is a component of the Linux Kernel ecosystem. It provides support for Mellanox network adapters, specifically the mlx5e driver. This driver enables the functionality of Mellanox Ethernet cards, allowing them to communicate with the Linux operating system. The mlx5e driver is responsible for handling various network-related tasks, including packet processing and control flow. However, a vulnerability has been discovered in the CT (Connection Tracking) module of the mlx5e driver, which can lead to multiple allocations and a memory leak of mod acts.
Vulnerability Detail
The vulnerability in the net/mlx5e CT module arises from improper memory management. Specifically, there are multiple allocations and a memory leak of mod acts. This can result in memory exhaustion and potential denial-of-service (DoS) attacks. An attacker could exploit this vulnerability by sending specially crafted network packets, causing the system to allocate excessive memory and eventually crash. The vulnerability was introduced in Linux Kernel version v5.7 and has been fixed in version v5.15.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The net/mlx5e CT module in the Linux Kernel is vulnerable to multiple allocations and a memory leak of mod acts. This can result in memory exhaustion and potential denial-of-service attacks. It is crucial to update the Linux Kernel to version v5.15.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
net/mlx5e is a component of the Linux Kernel ecosystem that provides support for Mellanox network adapters.
The CT (Connection Tracking) module in net/mlx5e is responsible for tracking and managing network connections.
The vulnerability can lead to memory exhaustion and potential denial-of-service (DoS) attacks.
An attacker can exploit this vulnerability by sending specially crafted network packets, causing excessive memory allocation and potentially crashing the system.
To fix this vulnerability, update the Linux Kernel to version v5.15.5 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
