Bug 2123549 (CVE-2022-28199)

Summary:	CVE-2022-28199 dpdk: error recovery in mlx5 driver not handled properly, allowing for denial of service
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aconole, apevec, chrisw, ctrautma, echaudro, eglynn, fleitner, jburrell, jhsiao, jjoyce, lhh, linville, mburns, mgarciac, nhorman, ovs-qe, ovs-team, ralongi, rkhan, sfowler, spower, tredaelli, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	dpdk 21.11.2, dpdk 20.11.6, dpdk 19.11.13	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in the DPDK package. Affected versions of this package are vulnerable to denial of service (DoS) attacks, affecting system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-05 22:37:28 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2123136, 2123139, 2123143, 2123145, 2123146, 2123550, 2123552, 2123553, 2123554, 2123555, 2123557, 2123559, 2123615, 2123616, 2127135
Bug Blocks:	2123551

Description Sam Fowler 2022-09-02 00:07:27 UTC

A vulnerability was fixed in DPDK.  When having a failure with the mlx5 driver, the error recovery was not handled properly, which can allow a remote attacker to cause denial of service and some impact to data integrity and confidentiality.


Commits per branch:
	main  - https://git.dpdk.org/dpdk/commit/?id=60b254e392
	21.11 - https://git.dpdk.org/dpdk-stable/commit/?id=25c01bd323
	20.11 - https://git.dpdk.org/dpdk-stable/commit/?id=ef311075d2
	19.11 - https://git.dpdk.org/dpdk-stable/commit/?id=8b090f2664

LTS Releases:
	21.11 - http://fast.dpdk.org/rel/dpdk-21.11.2.tar.xz
	20.11 - http://fast.dpdk.org/rel/dpdk-20.11.6.tar.xz
	19.11 - http://fast.dpdk.org/rel/dpdk-19.11.13.tar.xz

Comment 1 Sam Fowler 2022-09-02 00:07:50 UTC

Created dpdk tracking bugs for this issue:

Affects: fedora-all [bug 2123550]

Comment 16 errata-xmlrpc 2022-09-13 18:15:14 UTC

This issue has been addressed in the following products:

  Fast Datapath for Red Hat Enterprise Linux 9

Via RHSA-2022:6503 https://access.redhat.com/errata/RHSA-2022:6503

Comment 17 errata-xmlrpc 2022-09-13 18:22:00 UTC

This issue has been addressed in the following products:

  Fast Datapath for Red Hat Enterprise Linux 8

Via RHSA-2022:6502 https://access.redhat.com/errata/RHSA-2022:6502

Comment 18 errata-xmlrpc 2022-09-13 18:22:17 UTC

This issue has been addressed in the following products:

  Fast Datapath for Red Hat Enterprise Linux 8

Via RHSA-2022:6504 https://access.redhat.com/errata/RHSA-2022:6504

Comment 19 errata-xmlrpc 2022-09-13 18:22:31 UTC

This issue has been addressed in the following products:

  Fast Datapath for Red Hat Enterprise Linux 8

Via RHSA-2022:6505 https://access.redhat.com/errata/RHSA-2022:6505

Comment 20 errata-xmlrpc 2022-09-13 18:22:54 UTC

This issue has been addressed in the following products:

  Fast Datapath for Red Hat Enterprise Linux 8

Via RHSA-2022:6506 https://access.redhat.com/errata/RHSA-2022:6506

Comment 21 Jean-Tsung Hsiao 2022-09-16 14:20:49 UTC

We have done sanity tests against mlx5 CVE fixes using FDP 22.G.2 openvswitch builds. All tests passed. Thus, we have verified this bug.

Below is out test results spreadsheet:
https://docs.google.com/spreadsheets/d/1U9nZRcgzXTd1kLuP2GgTGM2DaaJ-6jlYT2UYvX8Gb9g/edit#gid=398691140

NOTE: There will be separate erratas to verified dpdk 21.11.2, dpdk 20.11.6, dpdk 19.11.13 individually.

Comment 23 errata-xmlrpc 2022-11-15 10:46:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8263 https://access.redhat.com/errata/RHSA-2022:8263

Comment 24 Product Security DevOps Team 2022-12-05 22:37:25 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-28199