CVE-2023-23006

What it actually does

Misinterpretation of mlx5_get_uars_page error pointer return value as a valid pointer instead of checking for error condition leads to dereference of invalid memory in mlx5 steering domain initialization.

Why it matters to the business

Systems using affected Mellanox mlx5 Ethernet drivers may experience kernel crashes or denial of service, disrupting network operations on Linux servers and potentially requiring reboots or downtime for remediation.

How an attack unfolds

An attacker with local access triggers mlx5 steering domain setup code that calls mlx5_get_uars_page; the function returns an error pointer on failure but the code treats it as a valid address, causing invalid memory access and potential crash.

How to fix it

Update Linux kernel to version 5.15.13 or later, or apply commit 6b8b42585886c59a008015083282aae434349094 in torvalds/linux.

How to confirm the fix worked

Verify kernel version is at least 5.15.13; confirm presence of the fix commit in source tree; test mlx5 driver initialization under error conditions for mlx5_get_uars_page.

Typical attack path

1. Obtain local user access on a system with vulnerable mlx5 driver loaded
2. Trigger mlx5 steering domain allocation via network configuration or driver initialization paths
3. Cause mlx5_get_uars_page to return error pointer through resource exhaustion or specific device state
4. Observe kernel dereference of error pointer leading to oops or panic

How to detect it

Review kernel logs for oops or panic messages involving mlx5 or dr_domain.c; search system logs for mlx5 steering initialization failures around crash times.

What your security team should do

• Prioritize kernel upgrade on all systems using mlx5 Ethernet hardware
• Monitor for kernel oops or panics related to mlx5 steering
• Apply updates within standard maintenance windows given moderate CVSS and low EPSS