ACK: [SRU][J][PATCH 0/1] CVE-2022-49234

[Andrei Gherzan]

On 26/09/08 09:56PM, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2022-49234
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> net: dsa: Avoid cross-chip syncing of VLAN filtering
> 
> Changes to VLAN filtering are not applicable to cross-chip notifications.
> 
> On a system like this:
> 
> .-----.   .-----.   .-----.
> | sw1 +---+ sw2 +---+ sw3 |
> '-1-2-'   '-1-2-'   '-1-2-'
> 
> Before this change, upon sw1p1 leaving a bridge, a call to
> dsa_port_vlan_filtering would also be made to sw2p1 and sw3p1.
> 
> In this scenario:
> 
> .---------.   .-----.   .-----.
> |   sw1   +---+ sw2 +---+ sw3 |
> '-1-2-3-4-'   '-1-2-'   '-1-2-'
> 
> When sw1p4 would leave a bridge, dsa_port_vlan_filtering would be called for
> sw2 and sw3 with a non-existing port - leading to array out-of-bounds accesses
> and crashes on mv88e6xxx.
> 
> [ Fix ]
> 
> jammy/linux: backported from 108dc8741c20
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> This change only affects the DSA (Distributed Switch Architecture)
> subsystem, and in particular multi-chip topologies where two or more
> Ethernet switches are daisy-chained, such as boards using mv88e6xxx
> switches. A bad fix could regress VLAN filtering behaviour when ports
> leave a bridge on those cross-chip setups. Systems without DSA hardware, or
> with a single DSA switch, are not affected by this code path.
> 
> [ Other Info ]
> 
> Kybele flow-v11-21-g0f091652. Reference: 5fdfa656/v1

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260911/1326dd46/attachment.sig>