Race Condition in Linux Kernel Ocelot Network Switch

Impact Analysis

This vulnerability involves missing lock protection in the Linux kernel's mscc ocelot driver during certain function calls related to packet injection. Without proper locking, there could be race conditions or data corruption when multiple threads access the injection group concurrently. This could potentially lead to instability or unexpected behavior in network packet transmission on affected systems.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Linux kernel's mscc ocelot driver, specifically in the function ocelot_port_xmit_inj(). The issue is that this function calls ocelot_can_inject() and ocelot_port_inject_frame() without holding the required injection group lock. Both of these functions expect the injection lock to be held, as indicated by their lockdep_assert_held() checks.

The correct behavior, as seen in the caller felix_port_deferred_xmit(), is to acquire the injection lock using ocelot_lock_inj_grp() before calling these functions. The vulnerability was fixed by adding the missing lock acquisition and release (ocelot_lock_inj_grp()/ocelot_unlock_inj_grp()) around the register injection path. The FDMA path is unaffected because it uses a different locking mechanism.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the missing lock protection in ocelot_port_xmit_inj() has been fixed.

Specifically, the fix involves adding ocelot_lock_inj_grp()/ocelot_unlock_inj_grp() calls around the register injection path to properly protect the injection group lock.

Since the FDMA path is not affected, focus on applying the patch or update that addresses the locking issue in the ocelot driver.

Useful 0 Not Useful 0