CVE-2022-48746 in Linux
Summary
by MITRE • 06/20/2024
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix handling of wrong devices during bond netevent
Current implementation of bond netevent handler only check if the handled netdev is VF representor and it missing a check if the VF representor is on the same phys device of the bond handling the netevent.
Fix by adding the missing check and optimizing the check if the netdev is VF representor so it will not access uninitialized private data and crashes.
BUG: kernel NULL pointer dereference, address: 000000000000036c PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI
Workqueue: eth3bond0 bond_mii_monitor [bonding]
RIP: 0010:mlx5e_is_uplink_rep+0xc/0x50 [mlx5_core]
RSP: 0018:ffff88812d69fd60 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8881cf800000 RCX: 0000000000000000 RDX: ffff88812d69fe10 RSI: 000000000000001b RDI: ffff8881cf800880 RBP: ffff8881cf800000 R08: 00000445cabccf2b R09: 0000000000000008 R10: 0000000000000004 R11: 0000000000000008 R12: ffff88812d69fe10 R13: 00000000fffffffe R14: ffff88820c0f9000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88846fb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000036c CR3: 0000000103d80006 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5e_eswitch_uplink_rep+0x31/0x40 [mlx5_core]
mlx5e_rep_is_lag_netdev+0x94/0xc0 [mlx5_core]
mlx5e_rep_esw_bond_netevent+0xeb/0x3d0 [mlx5_core]
raw_notifier_call_chain+0x41/0x60 call_netdevice_notifiers_info+0x34/0x80 netdev_lower_state_changed+0x4e/0xa0 bond_mii_monitor+0x56b/0x640 [bonding]
process_one_work+0x1b9/0x390 worker_thread+0x4d/0x3d0 ? rescuer_thread+0x350/0x350 kthread+0x124/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 01/07/2025
The vulnerability CVE-2022-48746 represents a critical kernel NULL pointer dereference in the Linux kernel's mlx5 core driver, specifically within the bonding module's network event handling mechanism. This flaw manifests when processing network events related to bond devices and virtual function (VF) representors, creating a scenario where the kernel attempts to access uninitialized private data structures leading to system crashes and potential denial of service conditions. The vulnerability resides in the mlx5e_rep_esw_bond_netevent function which handles network events for mlx5 core driver's switch fabric components, particularly affecting systems utilizing Mellanox ConnectX network adapters with bonding configurations.
The technical root cause stems from insufficient validation within the bond netevent handler implementation. The current code only verifies whether a network device is a VF representor but fails to validate whether this VF representor belongs to the same physical device as the bond currently processing the event. This missing validation allows for improper device handling when multiple physical devices are involved in bonding configurations, particularly in complex network topologies. The flaw specifically occurs in the mlx5e_is_uplink_rep function where uninitialized private data is accessed at address 0x36c, triggering a kernel NULL pointer dereference that results in immediate system instability.
The operational impact of this vulnerability extends beyond simple system crashes to potentially enable privilege escalation and persistent denial of service conditions within network infrastructure environments. Attackers could exploit this vulnerability by manipulating network device events in bonded configurations, particularly in data center or high-performance computing environments where Mellanox adapters and bonding are commonly deployed. The vulnerability affects systems running Linux kernel versions that include the mlx5 core driver and bonding module, with the specific crash occurring in the workqueue context during bond_mii_monitor execution, indicating that monitoring operations could be leveraged for exploitation.
Mitigation strategies for CVE-2022-48746 require immediate kernel updates to patched versions that include the proper device validation checks. System administrators should prioritize applying security patches from their respective Linux distributions or directly from the kernel.org repository. Additionally, implementing network monitoring and intrusion detection systems can help identify anomalous network device event patterns that might indicate exploitation attempts. The fix addresses the underlying CWE-476 NULL pointer dereference vulnerability by ensuring proper validation of VF representor device associations before accessing private data structures. Organizations should also consider implementing network segmentation and access controls to limit potential exploitation vectors. The ATT&CK framework categorizes this vulnerability under T1499.004 Network Denial of Service and T1068 Local Privilege Escalation, emphasizing the need for both preventive measures and incident response capabilities when dealing with kernel-level vulnerabilities in network infrastructure components.