CVE-2023-52487

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix peer flow lists handling

The cited change refactored mlx5e_tc_del_fdb_peer_flow() to only clear DUP

flag when list of peer flows has become empty. However, if any concurrent

user holds a reference to a peer flow (for example, the neighbor update

workqueue task is updating peer flow's parent encap entry concurrently),

then the flow will not be removed from the peer list and, consecutively,

DUP flag will remain set. Since mlx5e_tc_del_fdb_peers_flow() calls

mlx5e_tc_del_fdb_peer_flow() for every possible peer index the algorithm

will try to remove the flow from eswitch instances that it has never peered

with causing either NULL pointer dereference when trying to remove the flow

peer list head of peer_index that was never initialized or a warning if the

list debug config is enabled[0].

Fix the issue by always removing the peer flow from the list even when not

releasing the last reference to it.

[0]:

[

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References