CVE-2022-48932
Severity CVSS v4.0:
Pending analysis
Type:
CWE-125
Out-of-bounds Read
Publication date:
22/08/2024
Last modified:
23/08/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte<br />
<br />
When adding a rule with 32 destinations, we hit the following out-of-band<br />
access issue:<br />
<br />
BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70<br />
<br />
This patch fixes the issue by both increasing the allocated buffers to<br />
accommodate for the needed actions and by checking the number of actions<br />
to prevent this issue when a rule with too many actions is provided.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 5.16.12 (excluding) |
To consult the complete list of CPE names with products and versions, see this page