Improper error handling in Linux kernel qlogic qede driver

1) Improper error handling

EUVDB-ID: #VU104761

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49084

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the qede_build_skb() function in drivers/net/ethernet/qlogic/qede/qede_fp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/034a92c6a81048128fc7b18d278d52438a13902a
https://git.kernel.org/stable/c/4e910dbe36508654a896d5735b318c0b88172570
https://git.kernel.org/stable/c/8928239e5e2e460d95b8a0b89f61671625e7ece0
https://git.kernel.org/stable/c/9648adb1b3ece55c657d3a4f52bfee663b710dfe
https://git.kernel.org/stable/c/b2d6b3db9d1cf80908964036dbe1c52a86b1afb1
https://git.kernel.org/stable/c/c9bdce2359b5f4986eb38d1e81865b3586cc20d2
https://git.kernel.org/stable/c/e1fd0c42acfa22bb34d2ab6a111484f466ab8093

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.