CVE-2022-49626

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sfc: fix use after free when disabling sriov

Use after free is detected by kfence when disabling sriov. What was read

after being freed was vf->pci_dev: it was freed from pci_disable_sriov

and later read in efx_ef10_sriov_free_vf_vports, called from

efx_ef10_sriov_free_vf_vswitching.

Set the pointer to NULL at release time to not trying to read it later.

Reproducer and dmesg log (note that kfence doesn't detect it every time):

$ echo 1 > /sys/class/net/enp65s0f0np0/device/sriov_numvfs

$ echo 0 > /sys/class/net/enp65s0f0np0/device/sriov_numvfs

BUG: KFENCE: use-after-free read in efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc]

Use-after-free read at 0x00000000ff3c1ba5 (in kfence-#224):

efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc]

efx_ef10_pci_sriov_disable+0x38/0x70 [sfc]

efx_pci_sriov_configure+0x24/0x40 [sfc]

sriov_numvfs_store+0xfe/0x140

kernfs_fop_write_iter+0x11c/0x1b0

new_sync_write+0x1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References