CVE-2023-52667

What it actually does

Double-free vulnerability in mlx5e flow table creation path allowing memory corruption when allocation succeeds partially in fs_any_create_groups.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or gain elevated privileges, leading to system downtime, data loss, or full host compromise on servers and devices using mlx5 network hardware.

How an attack unfolds

An attacker with local access crafts network flow table operations that cause kvzalloc to fail after kcalloc succeeds, triggering the double-free in the error path of fs_any_create_groups and subsequent mlx5e_destroy_flow_table call.

How to fix it

Upgrade the Linux kernel to a version containing commit 72a729868592752b5a294d27453da264106983b1 or later; rebuild and reboot with the patched kernel; apply vendor backports if using distribution kernels.

How to confirm the fix worked

Confirm kernel source contains the NULL assignment after kvzalloc failure in fs_any_create_groups; verify no double-free paths remain via code review or runtime testing with fault injection on allocation; check uname and kernel build logs post-upgrade.

Typical attack path

1. Obtain local unprivileged access to a Linux host with mlx5e driver loaded
2. Trigger fs_any_create_table via crafted ethtool or tc flow rules that exercise the allocation error path
3. Cause selective allocation failure to invoke double-free of ft->g structure
4. Leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Search kernel logs and audit trails for allocation failure patterns followed by use-after-free or double-free panics in mlx5e or fs_any functions; inspect crash dumps for ft->g pointer reuse.

What your security team should do

• Prioritize patching all systems exposing mlx5e drivers within 30 days due to high local impact
• Restrict unprivileged local access and monitor for unusual flow table operations
• Test patched kernels in staging environments before broad deployment
• Review downstream dependent packages and rebuild any custom modules