CVE-2022-48966

What it actually does

Missing bounds check on user-supplied pp->indir[0] value allows out-of-bounds read when passed to cpu_online() inside mvneta_percpu_elect() in the mvneta Ethernet driver.

Why it matters to the business

Potential system instability or information disclosure on affected Linux-based network appliances, increasing operational risk and patch urgency for organizations running downstream packages with high ecosystem prevalence.

How an attack unfolds

An attacker with local access supplies an out-of-range RSS indirection table index; the value bypasses validation and is dereferenced against the CPU bitmap, triggering an out-of-bounds read that can be leveraged for kernel memory disclosure or denial of service. Listed threat actors in 2024 zero-day campaigns and Linux kernel resource-handling operations have shown interest in similar kernel flaws.

How to fix it

Upgrade the affected package to the fixed commit e018cf0fc0979d2abe25ff705db019feb7523444 or later; apply the official Linux kernel patch that adds the required bounds check before the cpu_online() call.

How to confirm the fix worked

Confirm the running kernel contains the bounds check on pp->indir[0]; verify the pomerium/pomerium package reports the e018cf0fc0979d2abe25ff705db019feb7523444 commit or newer; re-test RSS configuration with out-of-range CPU values.

Typical attack path

1. Obtain local access or execute code on a system using the vulnerable mvneta driver
2. Invoke ethtool or equivalent interface to set an RSS indirection table with an invalid CPU index in indir[0]
3. Trigger mvneta_config_rss() followed by mvneta_percpu_elect() to perform the unchecked cpu_online() call
4. Read kernel memory beyond the CPU bitmap or cause a crash to achieve information leak or DoS

How to detect it

Review kernel logs for mvneta driver oops or out-of-bounds warnings around RSS configuration changes; inspect audit logs for unusual ethtool RSS table modifications; correlate with process execution of tools that alter network RSS settings.

What your security team should do

• Prioritize patching systems exposing the mvneta driver within the CISA-adjacent remediation window if applicable
• Monitor EPSS trend and threat actor reports for any increase in exploitation of similar Linux kernel memory issues
• Restrict unprivileged local access and ethtool usage on critical systems until patched