CVE-2022-50002

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: LAG, fix logic over MLX5_LAG_FLAG_NDEVS_READY

Only set MLX5_LAG_FLAG_NDEVS_READY if both netdevices are registered.

Doing so guarantees that both ldev->pf[MLX5_LAG_P0].dev and

ldev->pf[MLX5_LAG_P1].dev have valid pointers when

MLX5_LAG_FLAG_NDEVS_READY is set.

The core issue is asymmetry in setting MLX5_LAG_FLAG_NDEVS_READY and

clearing it. Setting it is done wrongly when both

ldev->pf[MLX5_LAG_P0].dev and ldev->pf[MLX5_LAG_P1].dev are set;

clearing it is done right when either of ldev->pf[i].netdev is cleared.

Consider the following scenario:

1. PF0 loads and sets ldev->pf[MLX5_LAG_P0].dev to a valid pointer

2. PF1 loads and sets both ldev->pf[MLX5_LAG_P1].dev and

ldev->pf[MLX5_LAG_P1].netdev with valid pointers. This results in

MLX5_LAG_FLAG_NDEVS_READY is set.

3. PF0 is unloaded before setting dev->pf[MLX5_LAG_P0].netdev.

MLX5_LAG_FLAG_NDEVS_READY remains set.

Further execution of mlx5_do_bon

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References