CVE-2022-48864
published 2024-07-16CVE-2022-48864: In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command When control vq…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
When control vq receives a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
request from the driver, presently there is no validation against the
number of queue pairs to configure, or even if multiqueue had been
negotiated or not is unverified. This may lead to kernel panic due to
uninitialized resource for the queues were there any bogus request
sent down by untrusted driver. Tie up the loose ends there.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.16.18-1 (bookworm) | linux 5.16.18-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 52893733f2c5886fc74be6c386d12b59a3f581df < e7e118416465f2ba8b55007e5b789823e101421e | e7e118416465f2ba8b55007e5b789823e101421e |
| linux | linux | >= 52893733f2c5886fc74be6c386d12b59a3f581df < 9f6effca75626c7a7c7620dabcb1a254ca530230 | 9f6effca75626c7a7c7620dabcb1a254ca530230 |
| linux | linux | >= 52893733f2c5886fc74be6c386d12b59a3f581df < ed0f849fc3a63ed2ddf5e72cdb1de3bdbbb0f8eb | ed0f849fc3a63ed2ddf5e72cdb1de3bdbbb0f8eb |
| linux | linux_kernel | >= 0 < 5.16.18-1 | 5.16.18-1 |
| linux | linux_kernel | >= 0 < 5.16.18-1 | 5.16.18-1 |
| linux | linux_kernel | >= 0 < 5.16.18-1 | 5.16.18-1 |
| linux | linux_kernel | >= 5.15 < 5.15.29 | 5.15.29 |
| linux | linux_kernel | >= 5.16 < 5.16.15 | 5.16.15 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
vendor_redhat·2024-07-16·CVSS 5.5
CVE-2022-48864 [MEDIUM] CWE-455 kernel: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
kernel: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
When control vq receives a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
request from the driver, presently there is no validation against the
number of queue pairs to configure, or even if multiqueue had been
negotiated or not is unverified. This may lead to kernel panic due to
uninitialized resource for the queues were there any bogus request
sent down by untrusted driver. Tie up the loose ends there.
A vulnerability was found in the Linux kernel's vdpa/mlx5 driver. The issue arises when this command is received without validating the number of queue pairs or confirming if multiq
Debian
CVE-2022-48864: linux - In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: ...
vendor_debian·2022·CVSS 5.5
CVE-2022-48864 [MEDIUM] CVE-2022-48864: linux - In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: ...
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command When control vq receives a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command request from the driver, presently there is no validation against the number of queue pairs to configure, or even if multiqueue had been negotiated or not is unverified. This may lead to kernel panic due to uninitialized resource for the queues were there any bogus request sent down by untrusted driver. Tie up the loose ends there.
Scope: local
bookworm: resolved (fixed in 5.16.18-1)
bullseye: resolved
forky: resolved (fixed in 5.16.18-1)
sid: resolved (fixed in 5.16.18-1)
trixie: resolved (fixed in 5.16.18-1)
GHSA
GHSA-6g4r-v8v9-hj9h: In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
When contr
ghsa_unreviewed·2024-07-16
CVE-2022-48864 [MEDIUM] CWE-908 GHSA-6g4r-v8v9-hj9h: In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
When contr
In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
When control vq receives a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
request from the driver, presently there is no validation against the
number of queue pairs to configure, or even if multiqueue had been
negotiated or not is unverified. This may lead to kernel panic due to
uninitialized resource for the queues were there any bogus request
sent down by untrusted driver. Tie up the loose ends there.
OSV
CVE-2022-48864: In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command When control
osv·2024-07-16·CVSS 5.5
CVE-2022-48864 [MEDIUM] CVE-2022-48864: In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command When control
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command When control vq receives a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command request from the driver, presently there is no validation against the number of queue pairs to configure, or even if multiqueue had been negotiated or not is unverified. This may lead to kernel panic due to uninitialized resource for the queues were there any bogus request sent down by untrusted driver. Tie up the loose ends there.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/9f6effca75626c7a7c7620dabcb1a254ca530230https://git.kernel.org/stable/c/e7e118416465f2ba8b55007e5b789823e101421ehttps://git.kernel.org/stable/c/ed0f849fc3a63ed2ddf5e72cdb1de3bdbbb0f8ebhttps://git.kernel.org/stable/c/9f6effca75626c7a7c7620dabcb1a254ca530230https://git.kernel.org/stable/c/e7e118416465f2ba8b55007e5b789823e101421ehttps://git.kernel.org/stable/c/ed0f849fc3a63ed2ddf5e72cdb1de3bdbbb0f8eb
2024-07-16
Published