CVE-2022-49234: net: dsa: Avoid cross-chip syncing of VLAN filtering
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: Avoid cross-chip syncing of VLAN filtering
Changes to VLAN filtering are not applicable to cross-chip notifications.
On a system like this:
.-----. .-----. .-----. | sw1 +---+ sw2 +---+ sw3 | '-1-2-' '-1-2-' '-1-2-'
Before this change, upon sw1p1 leaving a bridge, a call to dsaportvlanfiltering would also be made to sw2p1 and sw3p1.
In this scenario:
.---------. .-----. .-----. | sw1 +---+ sw2 +---+ sw3 | '-1-2-3-4-' '-1-2-' '-1-2-'
When sw1p4 would leave a bridge, dsaportvlanfiltering would be called for sw2 and sw3 with a non-existing port - leading to array out-of-bounds accesses and crashes on mv88e6xxx.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49234?
CVE-2022-49234 is considered a moderate severity vulnerability due to its impact on VLAN filtering across interconnected switches.
How do I fix CVE-2022-49234?
To fix CVE-2022-49234, update your Linux kernel to version 5.17.2 or later.
What systems are impacted by CVE-2022-49234?
CVE-2022-49234 affects Linux kernel versions from 5.2 up to 5.17.2.
What type of vulnerability is CVE-2022-49234?
CVE-2022-49234 is a vulnerability related to VLAN filtering in the Linux kernel.
Is there a workaround for CVE-2022-49234?
Currently, there is no known workaround for CVE-2022-49234 other than applying the patch or updating the kernel.