net/mlx5e: Nullify cq->dbg pointer in mlx5_debug_cq_remove()
Summary
UVI-2021-1002320: net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove(). Affects Kernel versions >= 94b960b9deffc02fc0747afc01f72cc62ab099e3, < 2ae38157080616a13a9fe3f0b4b6ec0070aa408a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/mlx5e package is a part of the Linux Kernel ecosystem. It provides support for Mellanox ConnectX-4 and ConnectX-5 Ethernet adapters. These adapters are commonly used in high-performance computing and data center environments. The package includes various components for managing and controlling the network interface, including the mlx5_debug_cq_remove() function.
Vulnerability Detail
The vulnerability identified as UVI-2021-1002320 in the net/mlx5e package involves a null pointer dereference issue in the mlx5_debug_cq_remove() function. This function is responsible for removing a debug entry from the completion queue (cq) of the network interface. However, it fails to nullify the cq->dbg pointer after removing the entry, potentially leading to a use-after-free vulnerability. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the vulnerability by refraining from using the mlx5_debug_cq_remove() function or any functionality that relies on it. However, this may limit the debugging capabilities of the net/mlx5e package. It is strongly recommended to apply the official fix by updating the Linux Kernel.
Conclusion
The net/mlx5e package in the Linux Kernel is vulnerable to a null pointer dereference issue in the mlx5_debug_cq_remove() function. This vulnerability can be mitigated by updating the Kernel to version v5.15.5 or later. It is recommended to apply the official fix to ensure the correct nullification of the cq->dbg pointer after removing a debug entry from the completion queue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/mlx5e package is a component of the Linux Kernel that provides support for Mellanox ConnectX-4 and ConnectX-5 Ethernet adapters.
The mlx5_debug_cq_remove() function is responsible for removing a debug entry from the completion queue (cq) of the network interface in the net/mlx5e package.
A null pointer dereference occurs when a program attempts to access or manipulate data through a null pointer, leading to a crash or potential security vulnerability.
This vulnerability could allow an attacker to execute arbitrary code or cause a denial-of-service condition by exploiting the use-after-free issue in the net/mlx5e package.
To fix this vulnerability, update the Linux Kernel to version v5.15.5 or later, which includes the necessary fix for the null pointer dereference issue.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
