CVE-2022-50476
Description
An incorrect function call was found in the Linux kernel Non-Transparent Bridge network driver's interrupt handling. When using AMD PTDMA DMA engines, the TX/RX callback handlers are invoked in hard interrupt context but call the interrupt-unsafe dev_kfree_skb() function to free network buffers, which results in kernel warnings and severe TCP/IP performance degradation.
Statement
The issue arises because ntb_netdev_tx_handler() and ntb_netdev_rx_handler() call dev_kfree_skb() to free socket buffers, but these handlers can be invoked in hard interrupt context when using certain DMA engines like AMD PTDMA. The dev_kfree_skb() function is not safe to call from interrupt context and should only be used in process context. When called from an interrupt handler, it triggers warnings from skb_release_head_state() because in_hardirq() returns true. On Intel IOAT DMA engines this issue doesn't manifest because that driver uses tasklets (softirq context) rather than hard interrupt handlers. On AMD systems, this causes both visible kernel warnings and severe TCP/IP performance degradation (order of magnitude slower than expected).
Mitigation
To mitigate this issue, prevent the ntb_netdev module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity,Availability,Confidentiality
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; Execute Unauthorized Code or Commands
This weakness may result in the corruption of memory, and perhaps instructions, possibly leading to a crash. If the corrupted memory can be effectively controlled, it may be possible to execute arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
