CVE-2022-48883
Last modified
CVE-2022-48883 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent A user is able to configure an arbitrary number of rx queues when creating an interface via netlink. This doesn't work for child PKEY interfaces because the child interface uses the parent receive channels. Although the child shares the parent's receive channels, the number of rx queues is important for the channel_stats array: the parent's rx channel index is used to access the child's channel_stats. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent A user is able to configure an arbitrary number of rx queues when creating an interface via netlink. This doesn't work for child PKEY interfaces because the child interface uses the parent receive channels. Although the child shares the parent's receive channels, the number of rx queues is important for the channel_stats array: the parent's rx channel index is used to access the child's channel_stats. So the array has to be at least as large as the parent's rx queue size for the counting to work correctly and to prevent out of bound accesses. This patch checks for the mentioned scenario and returns an error when trying to create the interface. The error is propagated to the user.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Linux | Linux Kernel | >= 5.17, < 6.1.7 | — |
| Linux | Linux Kernel | 6.2 | Rc1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-48883?
How severe is CVE-2022-48883?
How do I fix CVE-2022-48883?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-48878In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2022-48879In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-4888The Checkout Fields Manager WordPress plugin before 1.0.2, A…6.5
- CVE-2022-48880In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-48881In the Linux kernel, the following vulnerability has been re…7.1
- CVE-2022-48882In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-48884In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-48885In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-48886In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-48887In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-48888In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-48889In the Linux kernel, the following vulnerability has been re…5.5
Are you affected by CVE-2022-48883?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST