CVE-2022-48864 vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
A missing validation in the Linux kernel's vdpa/mlx5 driver allows an untrusted driver to trigger a kernel panic via a bogus multiqueue command.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48864?
CVE-2022-48864 is a high-severity vulnerability in Linux kernel, published on 16 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
When control vq receives a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command request from the driver, presently there is no validation against the number of queue pairs to configure, or even if multiqueue had been negotiated or not is unverified. This may lead to kernel panic due to uninitialized resource for the queues were there any bogus request sent down by untrusted driver. Tie up the loose ends there.
Weakness: CWE-908
Which versions are affected by CVE-2022-48864?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-48864?
Apply the vendor's patch.
Is CVE-2022-48864 being exploited?
There is no known exploitation of CVE-2022-48864 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-48864, GHSA-6g4r-v8v9-hj9h, UBUNTU-CVE-2022-48864.