Executive Summary

This vulnerability exists in the Linux kernel's mlx5_core driver, specifically in the function mlx5_query_nic_vport_mac_list. The function sizes its firmware command buffer based on the physical function's (PF) maximum unicast/multicast list capabilities. However, when querying a virtual function (VF) vport that has a larger configured maximum via devlink, the firmware response can overflow the allocated buffer.

This overflow leads to a slab-out-of-bounds error detected by Kernel Address Sanitizer (KASAN), which indicates that the kernel is reading beyond the allocated memory buffer. The issue arises because the buffer size is incorrectly determined, causing memory corruption.

The fix involves querying the vport's own Host Channel Adapter (HCA) capabilities to size the buffer correctly and refactoring the function to allocate and return the MAC list internally, removing the need for the caller to know the correct maximum size.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a kernel memory corruption due to a buffer overflow, which may lead to system instability, crashes, or denial of service.

Because it involves reading out-of-bounds memory in kernel space, it could potentially be exploited to execute arbitrary code or escalate privileges, although the exact impact depends on the attacker's capabilities and system configuration.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests as a slab-out-of-bounds error in the mlx5_query_nic_vport_mac_list function within the mlx5_core kernel module. Detection can be done by monitoring kernel logs for KASAN (Kernel Address Sanitizer) reports indicating slab-out-of-bounds errors related to mlx5_query_nic_vport_mac_list.

You can check the kernel logs for such errors using the following command:

• dmesg | grep -i 'mlx5_query_nic_vport_mac_list'
• journalctl -k | grep -i 'mlx5_query_nic_vport_mac_list'

Additionally, monitoring for BUG reports or KASAN slab-out-of-bounds messages related to mlx5_core in the kernel logs can help detect exploitation attempts or crashes caused by this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by correctly sizing the firmware command buffer when querying the vport's MAC list, specifically by querying the vport's own HCA capabilities and refactoring the function to allocate and return the MAC list internally.

Immediate mitigation steps include:

• Update the Linux kernel to a version that includes the fix for this vulnerability (post 7.0.0-rc6+ where the patch is applied).
• Avoid querying VF vports with larger configured max values via devlink until the kernel is updated.
• Monitor kernel logs for any signs of slab-out-of-bounds errors related to mlx5_core and take corrective action if detected.

Useful 0 Not Useful 0