CVE-2022-49096

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: sfc: add missing xdp queue reinitialization

After rx/tx ring buffer size is changed, kernel panic occurs when

it acts XDP_TX or XDP_REDIRECT.

When tx/rx ring buffer size is changed(ethtool -G), sfc driver

reallocates and reinitializes rx and tx queues and their buffer

(tx_queue->buffer).

But it misses reinitializing xdp queues(efx->xdp_tx_queues).

So, while it is acting XDP_TX or XDP_REDIRECT, it uses the uninitialized

tx_queue->buffer.

A new function efx_set_xdp_channels() is separated from efx_set_channels()

to handle only xdp queues.

Splat looks like:

BUG: kernel NULL pointer dereference, address: 000000000000002a

#PF: supervisor write access in kernel mode

#PF: error_code(0x0002) - not-present page

PGD 0 P4D 0

Oops: 0002 [#4] PREEMPT SMP NOPTI

RIP: 0010:efx_tx_map_chunk+0x54/0x90 [sfc]

CPU: 2 PID: 0 Comm: swapper/2 Tainted: G D 5.17.0+ #55 e8beeee8289528f11357029357cf

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References