CVE-2022-48980

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing()

The SJA1105 family has 45 L2 policing table entries

(SJA1105_MAX_L2_POLICING_COUNT) and SJA1110 has 110

(SJA1110_MAX_L2_POLICING_COUNT). Keeping the table structure but

accounting for the difference in port count (5 in SJA1105 vs 10 in

SJA1110) does not fully explain the difference. Rather, the SJA1110 also

has L2 ingress policers for multicast traffic. If a packet is classified

as multicast, it will be processed by the policer index 99 + SRCPORT.

The sja1105_init_l2_policing() function initializes all L2 policers such

that they don't interfere with normal packet reception by default. To have

a common code between SJA1105 and SJA1110, the index of the multicast

policer for the port is calculated because it's an index that is out of

bounds for SJA1105 but in bounds for SJA1110, and a bounds check is

performed.

The code fails to do the proper

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References