GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54262 (GCVE-0-2023-54262)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:15 – Updated: 2026-08-05 09:18
VLAI
Title
net/mlx5e: Don't clone flow post action attributes second time
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't clone flow post action attributes second time The code already clones post action attributes in mlx5e_clone_flow_attr_for_post_act(). Creating another copy in mlx5e_tc_post_act_add() is a erroneous leftover from original implementation. Instead, assign handle->attribute to post_attr provided by the caller. Note that cloning the attribute second time is not just wasteful but also causes issues like second copy not being properly updated in neigh update code which leads to following use-after-free: Feb 21 09:02:00 c-237-177-40-045 kernel: BUG: KASAN: use-after-free in mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_free_info+0x2a/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: ____kasan_slab_free+0x11a/0x1b0 Feb 21 09:02:00 c-237-177-40-045 kernel: page dumped because: kasan: bad access detected Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 8833): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0xf2ff71), err(-22) Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0 enp8s0f0: Failed to add post action rule Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5e_tc_encap_flows_add:190:(pid 8833): Failed to update flow post acts, -22 Feb 21 09:02:00 c-237-177-40-045 kernel: Call Trace: Feb 21 09:02:00 c-237-177-40-045 kernel: <TASK> Feb 21 09:02:00 c-237-177-40-045 kernel: dump_stack_lvl+0x57/0x7d Feb 21 09:02:00 c-237-177-40-045 kernel: print_report+0x170/0x471 Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0 Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: ? __module_address.part.0+0x62/0x200 Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_stub_create_flow_table+0xd0/0xd0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: ? __raw_spin_lock_init+0x3b/0x110 Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_cmd_create_fte+0x80/0xb0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: add_rule_fg+0xe80/0x19c0 [mlx5_core] -- Feb 21 09:02:00 c-237-177-40-045 kernel: Allocated by task 13476: Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90 Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_packet_reformat_alloc+0x7b/0x230 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_tc_tun_create_header_ipv4+0x977/0xf10 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_attach_encap+0x15b4/0x1e10 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: post_process_attr+0x305/0xa30 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_tc_add_fdb_flow+0x4c0/0xcf0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: __mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_configure_flower+0xcaa/0x4b90 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_setup_tc_cls_flower+0x99/0x1b0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_setup_tc_cb+0x133/0x1e0 [mlx5_core] -- Feb 21 09:02:00 c-237-177-40-045 kernel: Freed by task 8833: Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_s ---truncated---
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8300f225268be9ee2c0daf5a3f23929fcdcbf213 , < c382b693ffcb1f1ebf60d76ab9dedfe9ea13eedf (git)
Affected: 8300f225268be9ee2c0daf5a3f23929fcdcbf213 , < 8fd1dac646e6b08d03e3f1ad3c5b34255b1e08e8 (git)
Affected: 8300f225268be9ee2c0daf5a3f23929fcdcbf213 , < 2d57a514f9ab7d2d40f49b02d93edfcec8c78a9e (git)
Affected: 8300f225268be9ee2c0daf5a3f23929fcdcbf213 , < e9fce818fe003b6c527f25517b9ac08eb4661b5d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.28 , ≤ 6.1.* (semver)
Unaffected: 6.2.15 , ≤ 6.2.* (semver)
Unaffected: 6.3.2 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c",
            "drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c382b693ffcb1f1ebf60d76ab9dedfe9ea13eedf",
              "status": "affected",
              "version": "8300f225268be9ee2c0daf5a3f23929fcdcbf213",
              "versionType": "git"
            },
            {
              "lessThan": "8fd1dac646e6b08d03e3f1ad3c5b34255b1e08e8",
              "status": "affected",
              "version": "8300f225268be9ee2c0daf5a3f23929fcdcbf213",
              "versionType": "git"
            },
            {
              "lessThan": "2d57a514f9ab7d2d40f49b02d93edfcec8c78a9e",
              "status": "affected",
              "version": "8300f225268be9ee2c0daf5a3f23929fcdcbf213",
              "versionType": "git"
            },
            {
              "lessThan": "e9fce818fe003b6c527f25517b9ac08eb4661b5d",
              "status": "affected",
              "version": "8300f225268be9ee2c0daf5a3f23929fcdcbf213",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c",
            "drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.28",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.15",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Don\u0027t clone flow post action attributes second time\n\nThe code already clones post action attributes in\nmlx5e_clone_flow_attr_for_post_act(). Creating another copy in\nmlx5e_tc_post_act_add() is a erroneous leftover from original\nimplementation. Instead, assign handle-\u003eattribute to post_attr provided by\nthe caller. Note that cloning the attribute second time is not just\nwasteful but also causes issues like second copy not being properly updated\nin neigh update code which leads to following use-after-free:\n\nFeb 21 09:02:00 c-237-177-40-045 kernel: BUG: KASAN: use-after-free in mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_report+0xbb/0x1a0\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_stack+0x1e/0x40\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_set_track+0x21/0x30\nFeb 21 09:02:00 c-237-177-40-045 kernel:  __kasan_kmalloc+0x7a/0x90\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_stack+0x1e/0x40\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_set_track+0x21/0x30\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_free_info+0x2a/0x40\nFeb 21 09:02:00 c-237-177-40-045 kernel:  ____kasan_slab_free+0x11a/0x1b0\nFeb 21 09:02:00 c-237-177-40-045 kernel: page dumped because: kasan: bad access detected\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 8833): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0xf2ff71), err(-22)\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0 enp8s0f0: Failed to add post action rule\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5e_tc_encap_flows_add:190:(pid 8833): Failed to update flow post acts, -22\nFeb 21 09:02:00 c-237-177-40-045 kernel: Call Trace:\nFeb 21 09:02:00 c-237-177-40-045 kernel:  \u003cTASK\u003e\nFeb 21 09:02:00 c-237-177-40-045 kernel:  dump_stack_lvl+0x57/0x7d\nFeb 21 09:02:00 c-237-177-40-045 kernel:  print_report+0x170/0x471\nFeb 21 09:02:00 c-237-177-40-045 kernel:  ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_report+0xbb/0x1a0\nFeb 21 09:02:00 c-237-177-40-045 kernel:  ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  ? __module_address.part.0+0x62/0x200\nFeb 21 09:02:00 c-237-177-40-045 kernel:  ? mlx5_cmd_stub_create_flow_table+0xd0/0xd0 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  ? __raw_spin_lock_init+0x3b/0x110\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5_cmd_create_fte+0x80/0xb0 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  add_rule_fg+0xe80/0x19c0 [mlx5_core]\n--\nFeb 21 09:02:00 c-237-177-40-045 kernel: Allocated by task 13476:\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_stack+0x1e/0x40\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_set_track+0x21/0x30\nFeb 21 09:02:00 c-237-177-40-045 kernel:  __kasan_kmalloc+0x7a/0x90\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5_packet_reformat_alloc+0x7b/0x230 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_tc_tun_create_header_ipv4+0x977/0xf10 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_attach_encap+0x15b4/0x1e10 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  post_process_attr+0x305/0xa30 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_tc_add_fdb_flow+0x4c0/0xcf0 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  __mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_configure_flower+0xcaa/0x4b90 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_rep_setup_tc_cls_flower+0x99/0x1b0 [mlx5_core]\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_rep_setup_tc_cb+0x133/0x1e0 [mlx5_core]\n--\nFeb 21 09:02:00 c-237-177-40-045 kernel: Freed by task 8833:\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_s\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The use-after-free is driven by a NETEVENT_NEIGH_UPDATE for the tunnel next-hop, i.e. by ARP/ND traffic on the underlay L2 segment, which an unauthenticated attacker on the same segment can generate at will (gratuitous ARP changing the neighbour\u0027s MAC). It is not routable, so Adjacent rather than Network.\nAC:L - A single spoofed ARP reply carrying a different MAC for the next-hop IP makes mlx5e_rep_update_flows() run encap_flows_del() immediately followed by encap_flows_add(), and the stale second attribute copy is then dereferenced unconditionally \u2014 no race window, timing condition, or state outside the attacker\u0027s control, and it can be repeated arbitrarily.\nPR:N - The attacker needs no account or credentials on the target host; ARP/ND is unauthenticated. The tc/OVS hardware-offload configuration is a pre-existing deployment property set up by the administrator, not a privilege the attacker must hold.\nUI:N - The neighbour-update work runs automatically from the kernel netevent notifier; no administrator or user action is needed once offloaded tunnel flows with post actions exist.\nS:U - The freed object, the corrupted state, and the resulting crash or bad hardware rule all live within the host kernel\u0027s own security authority.\nC:H - The freed mlx5_pkt_reformat is read after free and its contents (the reformat id) are pushed into a SET_FLOW_TABLE_ENTRY command; once the slab is reclaimed by other kernel allocations this leaks heap contents into hardware steering state, and UAF read primitives are generally leverageable for broader disclosure.\nI:H - A use-after-free on a heap object whose value is programmed into the NIC\u0027s flow table lets a groomed reallocation install an attacker-influenced reformat context, corrupting packet steering/encapsulation on a shared eswitch, and UAFs generally provide the basis for write/control-flow primitives.\nA:H - The dereference of freed memory produces a KASAN report/oops (fatal with panic_on_oops) and, at minimum, a failed post-action rule that leaves the offloaded tunnel flow permanently broken \u2014 repeatable on demand by the adjacent attacker."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:18:42.630Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c382b693ffcb1f1ebf60d76ab9dedfe9ea13eedf"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fd1dac646e6b08d03e3f1ad3c5b34255b1e08e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d57a514f9ab7d2d40f49b02d93edfcec8c78a9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9fce818fe003b6c527f25517b9ac08eb4661b5d"
        }
      ],
      "title": "net/mlx5e: Don\u0027t clone flow post action attributes second time",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54262",
    "datePublished": "2025-12-30T12:15:55.556Z",
    "dateReserved": "2025-12-30T12:06:44.517Z",
    "dateUpdated": "2026-08-05T09:18:42.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54262",
      "date": "2026-09-16",
      "epss": "0.0026",
      "percentile": "0.17933"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54262\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-30T13:16:14.993\",\"lastModified\":\"2026-08-04T11:16:38.753\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: Don\u0027t clone flow post action attributes second time\\n\\nThe code already clones post action attributes in\\nmlx5e_clone_flow_attr_for_post_act(). Creating another copy in\\nmlx5e_tc_post_act_add() is a erroneous leftover from original\\nimplementation. Instead, assign handle-\u003eattribute to post_attr provided by\\nthe caller. Note that cloning the attribute second time is not just\\nwasteful but also causes issues like second copy not being properly updated\\nin neigh update code which leads to following use-after-free:\\n\\nFeb 21 09:02:00 c-237-177-40-045 kernel: BUG: KASAN: use-after-free in mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_report+0xbb/0x1a0\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_stack+0x1e/0x40\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_set_track+0x21/0x30\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  __kasan_kmalloc+0x7a/0x90\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_stack+0x1e/0x40\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_set_track+0x21/0x30\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_free_info+0x2a/0x40\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  ____kasan_slab_free+0x11a/0x1b0\\nFeb 21 09:02:00 c-237-177-40-045 kernel: page dumped because: kasan: bad access detected\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 8833): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0xf2ff71), err(-22)\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0 enp8s0f0: Failed to add post action rule\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5e_tc_encap_flows_add:190:(pid 8833): Failed to update flow post acts, -22\\nFeb 21 09:02:00 c-237-177-40-045 kernel: Call Trace:\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  \u003cTASK\u003e\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  dump_stack_lvl+0x57/0x7d\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  print_report+0x170/0x471\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_report+0xbb/0x1a0\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  ? __module_address.part.0+0x62/0x200\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  ? mlx5_cmd_stub_create_flow_table+0xd0/0xd0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  ? __raw_spin_lock_init+0x3b/0x110\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5_cmd_create_fte+0x80/0xb0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  add_rule_fg+0xe80/0x19c0 [mlx5_core]\\n--\\nFeb 21 09:02:00 c-237-177-40-045 kernel: Allocated by task 13476:\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_stack+0x1e/0x40\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_set_track+0x21/0x30\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  __kasan_kmalloc+0x7a/0x90\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5_packet_reformat_alloc+0x7b/0x230 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_tc_tun_create_header_ipv4+0x977/0xf10 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_attach_encap+0x15b4/0x1e10 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  post_process_attr+0x305/0xa30 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_tc_add_fdb_flow+0x4c0/0xcf0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  __mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_configure_flower+0xcaa/0x4b90 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_rep_setup_tc_cls_flower+0x99/0x1b0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_rep_setup_tc_cb+0x133/0x1e0 [mlx5_core]\\n--\\nFeb 21 09:02:00 c-237-177-40-045 kernel: Freed by task 8833:\\nFeb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_s\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nnet/mlx5e: No clonar los atributos de acci\u00f3n posterior de flujo por segunda vez\\n\\nEl c\u00f3digo ya clona los atributos de acci\u00f3n posterior en mlx5e_clone_flow_attr_for_post_act(). Crear otra copia en mlx5e_tc_post_act_add() es un remanente err\u00f3neo de la implementaci\u00f3n original. En su lugar, asignar handle-\u0026gt;attribute a post_attr proporcionado por el llamador. Tenga en cuenta que clonar el atributo por segunda vez no solo es un desperdicio, sino que tambi\u00e9n causa problemas como que la segunda copia no se actualice correctamente en el c\u00f3digo de actualizaci\u00f3n de \u0027neigh\u0027, lo que lleva al siguiente uso despu\u00e9s de liberaci\u00f3n:\\n\\nFeb 21 09:02:00 c-237-177-40-045 kernel: BUG: KASAN: use-after-free in mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0\\nFeb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40\\nFeb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30\\nFeb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90\\nFeb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40\\nFeb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30\\nFeb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_free_info+0x2a/0x40\\nFeb 21 09:02:00 c-237-177-40-045 kernel: ____kasan_slab_free+0x11a/0x1b0\\nFeb 21 09:02:00 c-237-177-40-045 kernel: page dumped because: kasan: bad access detected\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 8833): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0xf2ff71), err(-22)\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0 enp8s0f0: Failed to add post action rule\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5e_tc_encap_flows_add:190:(pid 8833): Failed to update flow post acts, -22\\nFeb 21 09:02:00 c-237-177-40-045 kernel: Traza de Llamada:\\nFeb 21 09:02:00 c-237-177-40-045 kernel: \\nFeb 21 09:02:00 c-237-177-40-045 kernel: dump_stack_lvl+0x57/0x7d\\nFeb 21 09:02:00 c-237-177-40-045 kernel: print_report+0x170/0x471\\nFeb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0\\nFeb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: ? __module_address.part.0+0x62/0x200\\nFeb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_stub_create_flow_table+0xd0/0xd0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: ? __raw_spin_lock_init+0x3b/0x110\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5_cmd_create_fte+0x80/0xb0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: add_rule_fg+0xe80/0x19c0 [mlx5_core]\\n--\\nFeb 21 09:02:00 c-237-177-40-045 kernel: Asignado por tarea 13476:\\nFeb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40\\nFeb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30\\nFeb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5_packet_reformat_alloc+0x7b/0x230 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_tc_tun_create_header_ipv4+0x977/0xf10 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_attach_encap+0x15b4/0x1e10 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: post_process_attr+0x305/0xa30 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_tc_add_fdb_flow+0x4c0/0xcf0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: __mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_configure_flower+0xcaa/0x4b90 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_setup_tc_cls_flower+0x99/0x1b0 [mlx5_core]\\nFeb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_setup_tc_cb+0x133/0x1e0 [mlx5_core]\\n--\\nFeb 21 09:02:00 c-237-177-40-045 kernel: Liberado por tarea 8833:\\nFeb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_s\\n---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c\",\"drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8300f225268be9ee2c0daf5a3f23929fcdcbf213\",\"lessThan\":\"c382b693ffcb1f1ebf60d76ab9dedfe9ea13eedf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8300f225268be9ee2c0daf5a3f23929fcdcbf213\",\"lessThan\":\"8fd1dac646e6b08d03e3f1ad3c5b34255b1e08e8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8300f225268be9ee2c0daf5a3f23929fcdcbf213\",\"lessThan\":\"2d57a514f9ab7d2d40f49b02d93edfcec8c78a9e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8300f225268be9ee2c0daf5a3f23929fcdcbf213\",\"lessThan\":\"e9fce818fe003b6c527f25517b9ac08eb4661b5d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c\",\"drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.28\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.15\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.2\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2d57a514f9ab7d2d40f49b02d93edfcec8c78a9e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8fd1dac646e6b08d03e3f1ad3c5b34255b1e08e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c382b693ffcb1f1ebf60d76ab9dedfe9ea13eedf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e9fce818fe003b6c527f25517b9ac08eb4661b5d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:13:11+00:00",
      "cve": "CVE-2023-54262",
      "id": "CVE-2023-54262",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "138",
      "product_status:known_not_affected": "104",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5e: Don\u0027t clone flow post action attributes second time",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54262.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.