CVE-2022-49333— net/mlx5: E-Switch, pair only capable devices
Possible ATT&CK Techniques 1AI
T1562.001Affected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | dd3fddb82780bfa24124834edd90bbc63bd689cc< 0cef0b7eb044bb8cfdaff4c1db55a8fd442f6bc9 | affected |
dd3fddb82780bfa24124834edd90bbc63bd689cc< cdbcdddb8076a09aa6ddaf20fd911fc787dca0e5 | affected | ||
dd3fddb82780bfa24124834edd90bbc63bd689cc< 3008e6a0049361e731b803c60fe8f3ab44e1d73f | affected | ||
4d253ea99fbac316cbe4bafaf36087b592c2cd49 | affected | ||
5.13.8< 5.14 | affected | ||
5.14 | affected | ||
< 5.14 | unaffected | ||
5.17.15≤ 5.17.* | unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-49333
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net/mlx5: E-Switch, pair only capable devices
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch, pair only capable devices OFFLOADS paring using devcom is possible only on devices that support LAG. Filter based on lag capabilities. This fixes an issue where mlx5_get_next_phys_dev() was called without holding the interface lock. This issue was found when commit bc4c2f2e0179 ("net/mlx5: Lag, filter non compatible devices") added an assert that verifies the interface lock is held. WARNING: CPU: 9 PID: 1706 at drivers/net/ethernet/mellanox/mlx5/core/dev.c:642 mlx5_get_next_phys_dev+0xd2/0x100 [mlx5_core] Modules linked in: mlx5_vdpa vringh vhost_iotlb vdpa mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_umad ib_ipoib ib_cm ib_uverbs ib_core overlay fuse [last unloaded: mlx5_core] CPU: 9 PID: 1706 Comm: devlink Not tainted 5.18.0-rc7+ #11 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5_get_next_phys_dev+0xd2/0x100 [mlx5_core] Code: 02 00 75 48 48 8b 85 80 04 00 00 5d c3 31 c0 5d c3 be ff ff ff ff 48 c7 c7 08 41 5b a0 e8 36 87 28 e3 85 c0 0f 85 6f ff ff ff <0f> 0b e9 68 ff ff ff 48 c7 c7 0c 91 cc 84 e8 cb 36 6f e1 e9 4d ff RSP: 0018:ffff88811bf47458 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88811b398000 RCX: 0000000000000001 RDX: 0000000080000000 RSI: ffffffffa05b4108 RDI: ffff88812daaaa78 RBP: ffff88812d050380 R08: 0000000000000001 R09: ffff88811d6b3437 R10: 0000000000000001 R11: 00000000fddd3581 R12: ffff88815238c000 R13: ffff88812d050380 R14: ffff8881018aa7e0 R15: ffff88811d6b3428 FS: 00007fc82e18ae80(0000) GS:ffff88842e080000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9630d1b421 CR3: 0000000149802004 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> mlx5_esw_offloads_devcom_event+0x99/0x3b0 [mlx5_core] mlx5_devcom_send_event+0x167/0x1d0 [mlx5_core] esw_offloads_enable+0x1153/0x1500 [mlx5_core] ? mlx5_esw_offloads_controller_valid+0x170/0x170 [mlx5_core] ? wait_for_completion_io_timeout+0x20/0x20 ? mlx5_rescan_drivers_locked+0x318/0x810 [mlx5_core] mlx5_eswitch_enable_locked+0x586/0xc50 [mlx5_core] ? mlx5_eswitch_disable_pf_vf_vports+0x1d0/0x1d0 [mlx5_core] ? mlx5_esw_try_lock+0x1b/0xb0 [mlx5_core] ? mlx5_eswitch_enable+0x270/0x270 [mlx5_core] ? __debugfs_create_file+0x260/0x3e0 mlx5_devlink_eswitch_mode_set+0x27e/0x870 [mlx5_core] ? mutex_lock_io_nested+0x12c0/0x12c0 ? esw_offloads_disable+0x250/0x250 [mlx5_core] ? devlink_nl_cmd_trap_get_dumpit+0x470/0x470 ? rcu_read_lock_sched_held+0x3f/0x70 devlink_nl_cmd_eswitch_set_doit+0x217/0x620
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mlx5 E-Switch未正确配对设备。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-49333
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-49333
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-49333 (3)
Same Patch Batch · Linux · 2025-02-26 · 706 CVEs total
| CVE-2022-49149 | 9.8 CRITICAL | rxrpc: Fix call timer start racing with call destruction |
| CVE-2022-49561 | 9.8 CRITICAL | netfilter: conntrack: re-fetch conntrack after insertion |
| CVE-2022-49407 | 9.8 CRITICAL | dlm: fix plock invalid read |
| CVE-2022-49362 | 9.8 CRITICAL | NFSD: Fix potential use-after-free in nfsd_file_put() |
| CVE-2022-49280 | 9.8 CRITICAL | NFSD: prevent underflow in nfssvc_decode_writeargs() |
| CVE-2022-49356 | 9.8 CRITICAL | SUNRPC: Trap RDMA segment overflows |
| CVE-2022-49418 | 9.8 CRITICAL | NFSv4: Fix free of uninitialized nfs4_label on referral lookup. |
| CVE-2022-49094 | 9.8 CRITICAL | net/tls: fix slab-out-of-bounds bug in decrypt_internal |
| CVE-2022-49093 | 9.8 CRITICAL | skbuff: fix coalescing for page_pool fragment recycling |
| CVE-2022-49260 | 9.8 CRITICAL | crypto: hisilicon/sec - fix the aead software fallback for engine |
| CVE-2022-49194 | 9.8 CRITICAL | net: bcmgenet: Use stronger register read/writes to assure ordering |
| CVE-2022-49201 | 9.8 CRITICAL | ibmvnic: fix race between xmit and reset |
| CVE-2022-49058 | 9.1 CRITICAL | cifs: potential buffer overflow in handling symlinks |
| CVE-2022-49535 | 8.8 HIGH | scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI |
| CVE-2022-49159 | 8.8 HIGH | scsi: qla2xxx: Implement ref count for SRB |
| CVE-2022-49138 | 8.8 HIGH | Bluetooth: hci_event: Ignore multiple conn complete events |
| CVE-2022-49479 | 8.8 HIGH | mt76: fix tx status related use-after-free race on station removal |
| CVE-2022-49470 | 8.8 HIGH | Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event |
| CVE-2022-49111 | 8.8 HIGH | Bluetooth: Fix use after free in hci_send_acl |
| CVE-2022-49114 | 8.8 HIGH | scsi: libfc: Fix use after free in fc_exch_abts_resp() |
Showing top 20 of 706 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-74583
net/sched: cls_route: fix fastmap use-after-free on filter - CVE-2026-74581
net: ipv6: clear suppressed fib6 rule result - CVE-2026-74582
packet: use consistent hard_header_len in non-ring send path - CVE-2026-74580
vhost: reset the vring metadata cache on vring reconfigurati - CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off
Same vendor: Linux
- CVE-2026-74583
net/sched: cls_route: fix fastmap use-after-free on filter - CVE-2026-74581
net: ipv6: clear suppressed fib6 rule result - CVE-2026-74582
packet: use consistent hard_header_len in non-ring send path - CVE-2026-74580
vhost: reset the vring metadata cache on vring reconfigurati - CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off
V. Comments for CVE-2022-49333
No comments yet