CVE-2022-48932

What it actually does

The flaw causes a slab-out-of-bounds write in mlx5_cmd_dr_create_fte when a flow rule with 32 destinations exceeds the pre-allocated action buffer size, leading to kernel memory corruption.

Why it matters to the business

Systems using affected Mellanox mlx5 network hardware can experience kernel crashes or denial-of-service, disrupting network operations and requiring reboots; high downstream Linux and Android prevalence increases exposure across servers and devices.

How an attack unfolds

An attacker with local access crafts a network flow rule containing the maximum number of actions, triggering the insufficient buffer check failure and out-of-bounds access during mlx5 destination rule creation.

How to fix it

Upgrade the Linux kernel to commit 4ad319cdfbe555b4ff67bc608736c46a6930c848 or later; for Android apply the 2022-02-01 security patch level in versions 10, 11, and 12; rebuild and reboot with the fixed mlx5 driver.

How to confirm the fix worked

Verify the running kernel contains commit 4ad319cdfbe555b4ff67bc608736c46a6930c848 via uname or /proc/version; confirm absence of the KASAN slab-out-of-bounds report when inserting 32-destination rules; test with mlx5 flow rule creation tools.

Typical attack path

1. Obtain local execution or user privileges on the target system
2. Use ethtool or tc to install a flow rule with exactly 32 destinations via the mlx5 driver
3. Trigger rule insertion path that calls mlx5_cmd_dr_create_fte without bounds validation
4. Cause slab-out-of-bounds memory corruption leading to kernel panic

How to detect it

Search kernel logs and dmesg for the exact KASAN slab-out-of-bounds message referencing mlx5_cmd_dr_create_fte; inspect audit logs for recent use of tc or ethtool flow rule creation commands on mlx5 interfaces.

• BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte
• mlx5_cmd_dr_create_fte+0x18ee/0x1e70

What your security team should do

• Apply the kernel or Android patch immediately on all systems exposing mlx5 hardware
• Prioritize reboot and driver reload on production servers and Android devices
• Monitor kernel logs for mlx5-related KASAN reports until patches are deployed
• Restrict unprivileged users from installing complex flow rules via tc or ethtool where feasible