In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Add a timeout to acquire the command queue semaphore
Prevent forced completion handling on an entry that has not yet been
assigned an index, causing an out of bounds access on idx = -22.
Instead of waiting indefinitely for the sem, blocking flow now waits for
index to be allocated or a sem acquisition timeout before beginning the
timer for FW completion.
Kernel log example:
mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "8e715cd613a1",
"lessThan": "4baae687a20e",
"versionType": "git"
},
{
"status": "affected",
"version": "8e715cd613a1",
"lessThan": "f9caccdd42e9",
"versionType": "git"
},
{
"status": "affected",
"version": "8e715cd613a1",
"lessThan": "2d0962d05c93",
"versionType": "git"
},
{
"status": "affected",
"version": "8e715cd613a1",
"lessThan": "94024332a129",
"versionType": "git"
},
{
"status": "affected",
"version": "8e715cd613a1",
"lessThan": "485d65e13571",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/cmd.c",
"include/linux/mlx5/driver.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.17",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.1.93",
"versionType": "custom",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.33",
"versionType": "custom",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.8.12",
"versionType": "custom",
"lessThanOrEqual": "6.8.*"
},
{
"status": "unaffected",
"version": "6.9.3",
"versionType": "custom",
"lessThanOrEqual": "6.9.*"
},
{
"status": "unaffected",
"version": "6.10",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/cmd.c",
"include/linux/mlx5/driver.h"
],
"defaultStatus": "affected"
}
]
git.kernel.org/stable/c/2d0962d05c93de391ce85f6e764df895f47c8918
git.kernel.org/stable/c/485d65e1357123a697c591a5aeb773994b247ad7
git.kernel.org/stable/c/4baae687a20ef2b82fde12de3c04461e6f2521d6
git.kernel.org/stable/c/94024332a129c6e4275569d85c0c1bfb2ae2d71b
git.kernel.org/stable/c/f9caccdd42e999b74303c9b0643300073ed5d319