Information disclosure in Linux kernel freescale dpaa2 driver

1) Information disclosure

EUVDB-ID: #VU99104

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48957

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() functions in drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c. A local user can gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/54d830e24247fa8361b016dd2069362866f45cb6
https://git.kernel.org/stable/c/785ee7a82297e1512d9061aae91699212ed65796
https://git.kernel.org/stable/c/4fad22a1281c500f15b172c9d261eff347ca634b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.