CVE-2022-48932

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-48932", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T06:06:23.299Z", "datePublished": "2024-08-22T03:31:25.989Z", "dateUpdated": "2026-08-05T08:52:59.108Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:59.108Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte\n\nWhen adding a rule with 32 destinations, we hit the following out-of-band\naccess issue:\n\n BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70\n\nThis patch fixes the issue by both increasing the allocated buffers to\naccommodate for the needed actions and by checking the number of actions\nto prevent this issue when a rule with too many actions is provided."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only when installing an mlx5 FDB software-steering flow rule (TC flower offload \u2192 mlx5_eswitch_add_offloaded_rule \u2192 mlx5_add_flow_rules \u2192 mlx5_cmd_dr_create_fte) via local netlink/TC, not by processing remote packets.\nAC:L - A rule with MLX5_MAX_FLOW_FWD_VPORTS (32) mirred destinations\u2014explicitly supported and commonly paired with a flow counter\u2014deterministically overflows the 32-slot fs_dr_actions/actions arrays; the attacker fully controls the rule and needs no race or uncontrollable layout.\nPR:L - Creating the offloaded TC flower rule requires CAP_NET_ADMIN, which is available to an unprivileged user via user+network namespaces (and to containers granted NET_ADMIN on representors in typical switchdev/NFV deployments), scoring PR:L per kernel guidance for tc/CAP_NET_ADMIN.\nUI:N - The attacker installs the multi-destination TC rule themselves; no separate victim action is required beyond the host already running mlx5 eswitch offloads with SMFS.\nS:U - Impact is slab corruption inside the host kernel\u2019s mlx5 steering path under the same OS authority; this is not a VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:H - The bug is a slab out-of-bounds write of an mlx5dr_action pointer past a kcalloc(32) array into adjacent kmalloc slab objects, which is memory corruption leverageable for kernel information disclosure.\nI:H - Out-of-bounds heap writes of kernel pointers corrupt adjacent slab objects and, per kernel guidance, yield arbitrary-write / control-flow hijacking primitives.\nA:H - The commit documents a KASAN slab-out-of-bounds fault in mlx5_cmd_dr_create_fte, and the resulting heap corruption can oops or panic the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c"], "versions": [{"version": "1ffd498901c1134a7cbecf5409e12c064c39cef9", "lessThan": "4ad319cdfbe555b4ff67bc608736c46a6930c848", "status": "affected", "versionType": "git"}, {"version": "1ffd498901c1134a7cbecf5409e12c064c39cef9", "lessThan": "0aec12d97b2036af0946e3d582144739860ac07b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.16.12", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "5.16.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "5.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4ad319cdfbe555b4ff67bc608736c46a6930c848"}, {"url": "https://git.kernel.org/stable/c/0aec12d97b2036af0946e3d582144739860ac07b"}], "title": "net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48932", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:32:46.595523Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:09.982Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48932", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:32:46.595523Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:15.583Z"}}], "cna": {"title": "net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only when installing an mlx5 FDB software-steering flow rule (TC flower offload \u2192 mlx5_eswitch_add_offloaded_rule \u2192 mlx5_add_flow_rules \u2192 mlx5_cmd_dr_create_fte) via local netlink/TC, not by processing remote packets.\nAC:L - A rule with MLX5_MAX_FLOW_FWD_VPORTS (32) mirred destinations\u2014explicitly supported and commonly paired with a flow counter\u2014deterministically overflows the 32-slot fs_dr_actions/actions arrays; the attacker fully controls the rule and needs no race or uncontrollable layout.\nPR:L - Creating the offloaded TC flower rule requires CAP_NET_ADMIN, which is available to an unprivileged user via user+network namespaces (and to containers granted NET_ADMIN on representors in typical switchdev/NFV deployments), scoring PR:L per kernel guidance for tc/CAP_NET_ADMIN.\nUI:N - The attacker installs the multi-destination TC rule themselves; no separate victim action is required beyond the host already running mlx5 eswitch offloads with SMFS.\nS:U - Impact is slab corruption inside the host kernel\u2019s mlx5 steering path under the same OS authority; this is not a VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:H - The bug is a slab out-of-bounds write of an mlx5dr_action pointer past a kcalloc(32) array into adjacent kmalloc slab objects, which is memory corruption leverageable for kernel information disclosure.\nI:H - Out-of-bounds heap writes of kernel pointers corrupt adjacent slab objects and, per kernel guidance, yield arbitrary-write / control-flow hijacking primitives.\nA:H - The commit documents a KASAN slab-out-of-bounds fault in mlx5_cmd_dr_create_fte, and the resulting heap corruption can oops or panic the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1ffd498901c1134a7cbecf5409e12c064c39cef9", "lessThan": "4ad319cdfbe555b4ff67bc608736c46a6930c848", "versionType": "git"}, {"status": "affected", "version": "1ffd498901c1134a7cbecf5409e12c064c39cef9", "lessThan": "0aec12d97b2036af0946e3d582144739860ac07b", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"status": "unaffected", "version": "0", "lessThan": "5.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.16.12", "versionType": "semver", "lessThanOrEqual": "5.16.*"}, {"status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/4ad319cdfbe555b4ff67bc608736c46a6930c848"}, {"url": "https://git.kernel.org/stable/c/0aec12d97b2036af0946e3d582144739860ac07b"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte\n\nWhen adding a rule with 32 destinations, we hit the following out-of-band\naccess issue:\n\n BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70\n\nThis patch fixes the issue by both increasing the allocated buffers to\naccommodate for the needed actions and by checking the number of actions\nto prevent this issue when a rule with too many actions is provided."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16.12", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.17", "versionStartIncluding": "5.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:59.108Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48932", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:52:59.108Z", "dateReserved": "2024-08-21T06:06:23.299Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-08-22T03:31:25.989Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4ad319cdfbe555b4ff67bc608736c46a6930c848", "status": "affected", "version": "1ffd498901c1134a7cbecf5409e12c064c39cef9", "versionType": "git"}, {"lessThan": "0aec12d97b2036af0946e3d582144739860ac07b", "status": "affected", "version": "1ffd498901c1134a7cbecf5409e12c064c39cef9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.16.*", "status": "unaffected", "version": "5.16.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C76BAB21-7F23-4AD8-A25F-CA7B262A2698", "versionEndExcluding": "5.16.12", "versionStartIncluding": "5.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte\n\nWhen adding a rule with 32 destinations, we hit the following out-of-band\naccess issue:\n\n BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70\n\nThis patch fixes the issue by both increasing the allocated buffers to\naccommodate for the needed actions and by checking the number of actions\nto prevent this issue when a rule with too many actions is provided."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net/mlx5: DR, corrigi\u00f3 slab-out-of-bounds en mlx5_cmd_dr_create_fte Al agregar una regla con 32 destinos, encontramos el siguiente problema de acceso fuera de banda: ERROR: KASAN: slab-out-of-bounds en mlx5_cmd_dr_create_fte+0x18ee/0x1e70 Este parche soluciona el problema aumentando los b\u00faferes asignados para acomodar las acciones necesarias y verificando la cantidad de acciones para evitar este problema cuando una regla con demasiadas acciones se proporciona."}], "id": "CVE-2022-48932", "lastModified": "2026-08-04T10:17:27.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-48932", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:32:46.595523Z", "version": "2.0.3"}}]}, "published": "2024-08-22T04:15:16.087", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0aec12d97b2036af0946e3d582144739860ac07b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4ad319cdfbe555b4ff67bc608736c46a6930c848"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte", "id": "2307188", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2307188"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte\nWhen adding a rule with 32 destinations, we hit the following out-of-band\naccess issue:\nBUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70\nThis patch fixes the issue by both increasing the allocated buffers to\naccommodate for the needed actions and by checking the number of actions\nto prevent this issue when a rule with too many actions is provided.", "A vulnerability was found in the Linux kernel's Ethernet fs_dr.c driver in the mlx5_cmd_dr_create_fte() function, where a slab-out-of-bounds can occur. This flaw is caused by how the driver allocates and manages memory when dealing with flow rules actions. A rule can have up to 32 destinations, but additional actions can also be stored in the same buffer used for destinations. The out-of-bounds access occurs when the allocated buffer size is insufficiently sized to contain all possible actions (more than 32), potentially leading to memory corruption or system instability."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2022-48932", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-48932\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-48932\nhttps://lore.kernel.org/linux-cve-announce/2024082223-CVE-2022-48932-9dc7@gregkh/T"], "statement": "Red Hat Enterprise Linux is not impacted by this CVE, as the vulnerability in question does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue and no further action or mitigation is necessary for systems running this operating system.", "threat_severity": "Moderate"}

{}