GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48932 (GCVE-0-2022-48932)

Vulnerability from cvelistv5 – Published: 2024-08-22 03:31 – Updated: 2026-08-05 08:52
VLAI
Title
net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte When adding a rule with 32 destinations, we hit the following out-of-band access issue: BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70 This patch fixes the issue by both increasing the allocated buffers to accommodate for the needed actions and by checking the number of actions to prevent this issue when a rule with too many actions is provided.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:32 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1ffd498901c1134a7cbecf5409e12c064c39cef9 , < 4ad319cdfbe555b4ff67bc608736c46a6930c848 (git)
Affected: 1ffd498901c1134a7cbecf5409e12c064c39cef9 , < 0aec12d97b2036af0946e3d582144739860ac07b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 5.16.12 , ≤ 5.16.* (semver)
Unaffected: 5.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48932",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:32:46.595523Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:09.982Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4ad319cdfbe555b4ff67bc608736c46a6930c848",
              "status": "affected",
              "version": "1ffd498901c1134a7cbecf5409e12c064c39cef9",
              "versionType": "git"
            },
            {
              "lessThan": "0aec12d97b2036af0946e3d582144739860ac07b",
              "status": "affected",
              "version": "1ffd498901c1134a7cbecf5409e12c064c39cef9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.12",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte\n\nWhen adding a rule with 32 destinations, we hit the following out-of-band\naccess issue:\n\n  BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70\n\nThis patch fixes the issue by both increasing the allocated buffers to\naccommodate for the needed actions and by checking the number of actions\nto prevent this issue when a rule with too many actions is provided."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only when installing an mlx5 FDB software-steering flow rule (TC flower offload \u2192 mlx5_eswitch_add_offloaded_rule \u2192 mlx5_add_flow_rules \u2192 mlx5_cmd_dr_create_fte) via local netlink/TC, not by processing remote packets.\nAC:L - A rule with MLX5_MAX_FLOW_FWD_VPORTS (32) mirred destinations\u2014explicitly supported and commonly paired with a flow counter\u2014deterministically overflows the 32-slot fs_dr_actions/actions arrays; the attacker fully controls the rule and needs no race or uncontrollable layout.\nPR:L - Creating the offloaded TC flower rule requires CAP_NET_ADMIN, which is available to an unprivileged user via user+network namespaces (and to containers granted NET_ADMIN on representors in typical switchdev/NFV deployments), scoring PR:L per kernel guidance for tc/CAP_NET_ADMIN.\nUI:N - The attacker installs the multi-destination TC rule themselves; no separate victim action is required beyond the host already running mlx5 eswitch offloads with SMFS.\nS:U - Impact is slab corruption inside the host kernel\u2019s mlx5 steering path under the same OS authority; this is not a VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:H - The bug is a slab out-of-bounds write of an mlx5dr_action pointer past a kcalloc(32) array into adjacent kmalloc slab objects, which is memory corruption leverageable for kernel information disclosure.\nI:H - Out-of-bounds heap writes of kernel pointers corrupt adjacent slab objects and, per kernel guidance, yield arbitrary-write / control-flow hijacking primitives.\nA:H - The commit documents a KASAN slab-out-of-bounds fault in mlx5_cmd_dr_create_fte, and the resulting heap corruption can oops or panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:52:59.108Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4ad319cdfbe555b4ff67bc608736c46a6930c848"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aec12d97b2036af0946e3d582144739860ac07b"
        }
      ],
      "title": "net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48932",
    "datePublished": "2024-08-22T03:31:25.989Z",
    "dateReserved": "2024-08-21T06:06:23.299Z",
    "dateUpdated": "2026-08-05T08:52:59.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48932",
      "date": "2026-09-16",
      "epss": "0.00192",
      "percentile": "0.09097"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"5.16.12\", \"matchCriteriaId\": \"C76BAB21-7F23-4AD8-A25F-CA7B262A2698\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte\\n\\nWhen adding a rule with 32 destinations, we hit the following out-of-band\\naccess issue:\\n\\n  BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70\\n\\nThis patch fixes the issue by both increasing the allocated buffers to\\naccommodate for the needed actions and by checking the number of actions\\nto prevent this issue when a rule with too many actions is provided.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: net/mlx5: DR, corrigi\\u00f3 slab-out-of-bounds en mlx5_cmd_dr_create_fte Al agregar una regla con 32 destinos, encontramos el siguiente problema de acceso fuera de banda: ERROR: KASAN: slab-out-of-bounds en mlx5_cmd_dr_create_fte+0x18ee/0x1e70 Este parche soluciona el problema aumentando los b\\u00faferes asignados para acomodar las acciones necesarias y verificando la cantidad de acciones para evitar este problema cuando una regla con demasiadas acciones se proporciona.\"}]",
      "id": "CVE-2022-48932",
      "lastModified": "2024-08-23T01:48:35.663",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-08-22T04:15:16.087",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0aec12d97b2036af0946e3d582144739860ac07b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4ad319cdfbe555b4ff67bc608736c46a6930c848\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-125\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48932\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-22T04:15:16.087\",\"lastModified\":\"2026-08-04T10:17:27.060\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte\\n\\nWhen adding a rule with 32 destinations, we hit the following out-of-band\\naccess issue:\\n\\n  BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70\\n\\nThis patch fixes the issue by both increasing the allocated buffers to\\naccommodate for the needed actions and by checking the number of actions\\nto prevent this issue when a rule with too many actions is provided.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net/mlx5: DR, corrigi\u00f3 slab-out-of-bounds en mlx5_cmd_dr_create_fte Al agregar una regla con 32 destinos, encontramos el siguiente problema de acceso fuera de banda: ERROR: KASAN: slab-out-of-bounds en mlx5_cmd_dr_create_fte+0x18ee/0x1e70 Este parche soluciona el problema aumentando los b\u00faferes asignados para acomodar las acciones necesarias y verificando la cantidad de acciones para evitar este problema cuando una regla con demasiadas acciones se proporciona.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1ffd498901c1134a7cbecf5409e12c064c39cef9\",\"lessThan\":\"4ad319cdfbe555b4ff67bc608736c46a6930c848\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1ffd498901c1134a7cbecf5409e12c064c39cef9\",\"lessThan\":\"0aec12d97b2036af0946e3d582144739860ac07b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.12\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:32:46.595523Z\",\"id\":\"CVE-2022-48932\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.12\",\"matchCriteriaId\":\"C76BAB21-7F23-4AD8-A25F-CA7B262A2698\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0aec12d97b2036af0946e3d582144739860ac07b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4ad319cdfbe555b4ff67bc608736c46a6930c848\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:48:14+00:00",
      "cve": "CVE-2022-48932",
      "id": "CVE-2022-48932",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48932.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:32:29Z",
      "cve": "CVE-2022-48932",
      "id": "CVE-2022-48932",
      "initial_release_date": "2024-08-23T02:53:30Z",
      "product_status:known_affected": "310",
      "product_status:known_not_affected": "250",
      "product_status:recommended": "411",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48932",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48932.json",
      "version": "54"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48932\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:32:46.595523Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:15.583Z\"}}], \"cna\": {\"title\": \"net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached only when installing an mlx5 FDB software-steering flow rule (TC flower offload \\u2192 mlx5_eswitch_add_offloaded_rule \\u2192 mlx5_add_flow_rules \\u2192 mlx5_cmd_dr_create_fte) via local netlink/TC, not by processing remote packets.\\nAC:L - A rule with MLX5_MAX_FLOW_FWD_VPORTS (32) mirred destinations\\u2014explicitly supported and commonly paired with a flow counter\\u2014deterministically overflows the 32-slot fs_dr_actions/actions arrays; the attacker fully controls the rule and needs no race or uncontrollable layout.\\nPR:L - Creating the offloaded TC flower rule requires CAP_NET_ADMIN, which is available to an unprivileged user via user+network namespaces (and to containers granted NET_ADMIN on representors in typical switchdev/NFV deployments), scoring PR:L per kernel guidance for tc/CAP_NET_ADMIN.\\nUI:N - The attacker installs the multi-destination TC rule themselves; no separate victim action is required beyond the host already running mlx5 eswitch offloads with SMFS.\\nS:U - Impact is slab corruption inside the host kernel\\u2019s mlx5 steering path under the same OS authority; this is not a VM escape, IOMMU bypass, or other cross-boundary breakout.\\nC:H - The bug is a slab out-of-bounds write of an mlx5dr_action pointer past a kcalloc(32) array into adjacent kmalloc slab objects, which is memory corruption leverageable for kernel information disclosure.\\nI:H - Out-of-bounds heap writes of kernel pointers corrupt adjacent slab objects and, per kernel guidance, yield arbitrary-write / control-flow hijacking primitives.\\nA:H - The commit documents a KASAN slab-out-of-bounds fault in mlx5_cmd_dr_create_fte, and the resulting heap corruption can oops or panic the kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1ffd498901c1134a7cbecf5409e12c064c39cef9\", \"lessThan\": \"4ad319cdfbe555b4ff67bc608736c46a6930c848\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1ffd498901c1134a7cbecf5409e12c064c39cef9\", \"lessThan\": \"0aec12d97b2036af0946e3d582144739860ac07b\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.16.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4ad319cdfbe555b4ff67bc608736c46a6930c848\"}, {\"url\": \"https://git.kernel.org/stable/c/0aec12d97b2036af0946e3d582144739860ac07b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte\\n\\nWhen adding a rule with 32 destinations, we hit the following out-of-band\\naccess issue:\\n\\n  BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70\\n\\nThis patch fixes the issue by both increasing the allocated buffers to\\naccommodate for the needed actions and by checking the number of actions\\nto prevent this issue when a rule with too many actions is provided.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.12\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17\", \"versionStartIncluding\": \"5.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:52:59.108Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48932\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:52:59.108Z\", \"dateReserved\": \"2024-08-21T06:06:23.299Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-22T03:31:25.989Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.