CVE-2022-48884

What it actually does

Use-after-free in mlx5 command stats handling allows NULL pointer dereference when a failing FW command attempts to update stats after the stats structure has been freed and reallocated during devlink reload.

Why it matters to the business

Systems using Mellanox mlx5 network adapters may experience kernel crashes or panics during driver reload operations, leading to temporary loss of network connectivity and requiring system reboot.

How an attack unfolds

An attacker with local access triggers mlx5 devlink reload while simultaneously causing command interface failures; the subsequent stats update path dereferences a freed structure, resulting in a kernel paging fault and denial of service.

How to fix it

Update the Linux kernel to a version containing commit ddf458641a511e7dff19f3bf0cbbc5dd9fe08ce5 which statically allocates command stats on driver probe.

How to confirm the fix worked

Verify the presence of commit ddf458641a511e7dff19f3bf0cbbc5dd9fe08ce5 in the kernel source or confirm the mlx5_core module no longer performs dynamic allocation of command stats during reload.

Typical attack path

1. Obtain local access to a system with mlx5 hardware
2. Trigger devlink reload of the mlx5 device
3. Induce command failures during the reload window
4. Cause cmd_status_err to access the freed stats structure
5. Trigger kernel oops and potential system instability

How to detect it

Search kernel logs for the signature BUG: unable to handle kernel paging request followed by cmd_status_err and native_queued_spin_lock_slowpath during mlx5 reload events; examine dmesg and syslog for the call trace involving mlx5_access_reg and mlx5_query_port_ptys.

• cmd_status_err+0x55/0x110 [mlx5_core]
• BUG: unable to handle kernel paging request at 000000000002a9c0
• native_queued_spin_lock_slowpath+0x183/0x1d0
• _raw_spin_lock_irq+0x23/0x26
• mlx5_access_reg+0xe7/0x150 [mlx5_core]

What your security team should do

• Apply the kernel patch containing ddf458641a511e7dff19f3bf0cbbc5dd9fe08ce5 as soon as possible on systems with mlx5 hardware
• Test driver reload operations in a staging environment before production deployment
• Monitor kernel logs for cmd_status_err and spinlock faults during reload windows