CVE-2022-50726

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix possible use-after-free in async command interface

mlx5_cmd_cleanup_async_ctx should return only after all its callback

handlers were completed. Before this patch, the below race between

mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler was possible and

lead to a use-after-free:

1. mlx5_cmd_cleanup_async_ctx is called while num_inflight is 2 (i.e.

elevated by 1, a single inflight callback).

2. mlx5_cmd_cleanup_async_ctx decreases num_inflight to 1.

3. mlx5_cmd_exec_cb_handler is called, decreases num_inflight to 0 and

is about to call wake_up().

4. mlx5_cmd_cleanup_async_ctx calls wait_event, which returns

immediately as the condition (num_inflight == 0) holds.

5. mlx5_cmd_cleanup_async_ctx returns.

6. The caller of mlx5_cmd_cleanup_async_ctx frees the mlx5_async_ctx

object.

7. mlx5_cmd_exec_cb_handler goes on and calls wake_up() on the freed

object.

Fix it by syncing using a comp

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References