CVE-2022-48864: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: add validation for VIRTIONETCTRLMQVQPAIRSSET command
When control vq receives a VIRTIONETCTRLMQVQPAIRSSET command request from the driver, presently there is no validation against the number of queue pairs to configure, or even if multiqueue had been negotiated or not is unverified. This may lead to kernel panic due to uninitialized resource for the queues were there any bogus request sent down by untrusted driver. Tie up the loose ends there.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.16.18-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48864?
CVE-2022-48864 is classified with a high severity due to potential denial of service vulnerabilities.
How do I fix CVE-2022-48864?
To fix CVE-2022-48864, update the Linux kernel to versions 5.15.29 or 5.16.15 or later.
Which Linux kernel versions are affected by CVE-2022-48864?
CVE-2022-48864 affects Linux kernel versions between 5.15 and 5.15.29 and versions between 5.16 and 5.16.15.
What kind of vulnerability is CVE-2022-48864?
CVE-2022-48864 is a command validation issue in the Linux kernel's virtual device management which can lead to security issues.
Is CVE-2022-48864 exploitable remotely?
Yes, CVE-2022-48864 can be exploited remotely if an attacker can send crafted commands to the vulnerable kernel.