CVE-2022-48882

What it actually does

Null pointer dereference in mlx5e MACsec hardware offload path during SecY update when extended packet number (EPN) mode is enabled, because the rx_sa context is not available when attributes like salt and ssci are fetched.

Why it matters to the business

Systems using mlx5 MACsec offload can experience kernel crashes leading to denial of service; the flaw affects Linux kernel networking stacks and downstream Android devices that rely on the affected code.

How an attack unfolds

An attacker triggers a MACsec security entity (SecY) property update (such as encoding-sa) while EPN is enabled in the hardware offload path, causing the driver to dereference a null rx_sa pointer during SA attribute initialization.

How to fix it

Apply the upstream fix commit 514d9c6a39213d8200884e70f60ce7faef1ee597 or later stable equivalents; for Android devices upgrade to the patched releases dated 2021-07-01 in versions 8.1, 9, 10, and 11; ensure all downstream kernel images incorporate the corrected macsec SA handling.

How to confirm the fix worked

Verify the running kernel contains commit 514d9c6a39213d8200884e70f60ce7faef1ee597 or equivalent backport; confirm absence of the vulnerable rx_sa access pattern in net/mlx5e/macsec.c; test MACsec EPN configuration updates without triggering a null dereference.

Typical attack path

1. Obtain local or network access sufficient to initiate or modify a MACsec session on an affected mlx5e interface
2. Configure or update the MACsec SecY with EPN enabled
3. Perform a SecY property update that invokes the SA initialization routine
4. Trigger the null dereference resulting in kernel panic or crash

How to detect it

Review kernel logs for oops or panic entries referencing mlx5e_macsec or null dereference during SecY updates; correlate with MACsec interface configuration changes; no widespread in-the-wild exploitation artifacts are known.

What your security team should do

• Prioritize patching Linux kernel images and Android devices that use mlx5e MACsec offload
• Monitor for kernel oops or panic logs containing macsec references on affected hardware
• Apply the fix immediately on any systems exposing MACsec interfaces to untrusted networks