net/mlx5e: kTLS, Fix crash in RX resync flow
Summary
UVI-2021-1002321: net/mlx5e: kTLS, Fix crash in RX resync flow. Affects Kernel versions >= e9ce991bce5bacf71641bd0f72f4b7c589529f40, < ebeda7a9528ae690e6bf12791a868f0cca8391f2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/mlx5e package is a component of the Linux Kernel ecosystem. It provides support for Mellanox network adapters, specifically for the mlx5 Ethernet driver. This driver enables high-performance networking capabilities for Mellanox devices. The kTLS (Kernel Transport Layer Security) feature in net/mlx5e allows for secure communication over the network. However, a vulnerability has been discovered in the RX resync flow of kTLS, which can lead to a crash in the system.
Vulnerability Detail
The vulnerability in net/mlx5e's kTLS RX resync flow can result in a system crash. The issue was introduced in version v5.13 of the Linux Kernel and has been fixed in version v5.15.5. When this vulnerability is exploited, it can potentially lead to a denial-of-service (DoS) situation, impacting the availability of the affected system. The exact attack vectors and impact are yet to be proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the fix by updating the Linux Kernel to the recommended version.
Conclusion
The net/mlx5e package in the Linux Kernel is vulnerable to a crash in the RX resync flow of kTLS. This vulnerability can lead to a denial-of-service situation. To mitigate the risk, it is crucial to update the Linux Kernel to version v5.15.5 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
net/mlx5e is a component of the Linux Kernel ecosystem that provides support for Mellanox network adapters, specifically for the mlx5 Ethernet driver. It enables high-performance networking capabilities for Mellanox devices.
kTLS (Kernel Transport Layer Security) is a feature in net/mlx5e that allows for secure communication over the network. It provides encryption and authentication for network traffic.
The vulnerability in net/mlx5e's kTLS RX resync flow can lead to a system crash. It may result in a denial-of-service (DoS) situation, affecting the availability of the affected system.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.5 or later. This update includes the necessary patch to address the crash in the RX resync flow of net/mlx5e's kTLS.
No specific workaround has been provided for this vulnerability. It is advised to apply the fix by updating the Linux Kernel to the recommended version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
