CVE-2022-48719

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net, neigh: Do not trigger immediate probes on NUD_FAILED from neigh_managed_work

syzkaller was able to trigger a deadlock for NTF_MANAGED entries [0]:

kworker/0:16/14617 is trying to acquire lock:

ffffffff8d4dd370 (&tbl->lock){++-.}-{2:2}, at: ___neigh_create+0x9e1/0x2990 net/core/neighbour.c:652

[...]

but task is already holding lock:

ffffffff8d4dd370 (&tbl->lock){++-.}-{2:2}, at: neigh_managed_work+0x35/0x250 net/core/neighbour.c:1572

The neighbor entry turned to NUD_FAILED state, where __neigh_event_send()

triggered an immediate probe as per commit cd28ca0a3dd1 ("neigh: reduce

arp latency") via neigh_probe() given table lock was held.

One option to fix this situation is to defer the neigh_probe() back to

the neigh_timer_handler() similarly as pre cd28ca0a3dd1. For the case

of NTF_MANAGED, this deferral is acceptable given this only happens on

actual failure state and regular / expected state is NUD_V

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References