CVE-2022-48744

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Avoid field-overflowing memcpy()

In preparation for FORTIFY_SOURCE performing compile-time and run-time

field bounds checking for memcpy(), memmove(), and memset(), avoid

intentionally writing across neighboring fields.

Use flexible arrays instead of zero-element arrays (which look like they

are always overflowing) and split the cross-field memcpy() into two halves

that can be appropriately bounds-checked by the compiler.

We were doing:

#define ETH_HLEN 14

#define VLAN_HLEN 4

...

#define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN)

...

struct mlx5e_tx_wqe *wqe = mlx5_wq_cyc_get_wqe(wq, pi);

...

struct mlx5_wqe_eth_seg *eseg = &wqe->eth;

struct mlx5_wqe_data_seg *dseg = wqe->data;

...

memcpy(eseg->inline_hdr.start, xdptxd->data, MLX5E_XDP_MIN_INLINE);

target is wqe->eth.inline_hdr.start (which the compiler sees as being

2 bytes in size), but copying 18, intending

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References