Описание
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix use-after-free when reverting termination table
When having multiple dests with termination tables and second one
or afterwards fails the driver reverts usage of term tables but
doesn't reset the assignment in attr->dests[num_vport_dests].termtbl
which case a use-after-free when releasing the rule.
Fix by resetting the assignment of termtbl to null.
A use-after-free flaw was found in the Linux kernel ConnectX-4 and Connect-IB cards by the Mellanox Technologies driver. This flaw allows a local user to crash the system.
Отчет
This vulnerability is rated as Moderate because exploitation requires local administrative privileges (such as CAP_NET_ADMIN) and specialized Mellanox network hardware. On typical Red Hat Enterprise Linux deployments, the affected execution path is only invoked during advanced flow offloading configurations involving multiple destination tables on Mellanox ConnectX devices. Because unprivileged local accounts and remote actors cannot configure hardware steering rules, the attack surface is constrained, limiting the risk primarily to localized denial of service or system instability initiated by privileged operators.
Меры по смягчению последствий
To mitigate this issue, prevent module mlx5_core from being loaded. Please see https://access.redhat.com/solutions/41278 on how to blacklist a kernel module to prevent it from loading automatically.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
6.4 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free when reverting termination table When having multiple dests with termination tables and second one or afterwards fails the driver reverts usage of term tables but doesn't reset the assignment in attr->dests[num_vport_dests].termtbl which case a use-after-free when releasing the rule. Fix by resetting the assignment of termtbl to null.
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free when reverting termination table When having multiple dests with termination tables and second one or afterwards fails the driver reverts usage of term tables but doesn't reset the assignment in attr->dests[num_vport_dests].termtbl which case a use-after-free when releasing the rule. Fix by resetting the assignment of termtbl to null.
In the Linux kernel, the following vulnerability has been resolved: n ...
Security update for the Linux Kernel (Live Patch 49 for SLE 15 SP3)
Security update for the Linux Kernel (Live Patch 48 for SLE 15 SP3)
6.4 Medium
CVSS3