CVE-2022-50483

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: enetc: avoid buffer leaks on xdp_do_redirect() failure

Before enetc_clean_rx_ring_xdp() calls xdp_do_redirect(), each software

BD in the RX ring between index orig_i and i can have one of 2 refcount

values on its page.

We are the owner of the current buffer that is being processed, so the

refcount will be at least 1.

If the current owner of the buffer at the diametrically opposed index

in the RX ring (i.o.w, the other half of this page) has not yet called

kfree(), this page's refcount could even be 2.

enetc_page_reusable() in enetc_flip_rx_buff() tests for the page

refcount against 1, and [ if it's 2 ] does not attempt to reuse it.

But if enetc_flip_rx_buff() is put after the xdp_do_redirect() call,

the page refcount can have one of 3 values. It can also be 0, if there

is no owner of the other page half, and xdp_do_redirect() for this

buffer ran so far that it triggered a flush of the devmap/cpumap bulk

queu

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References