CVE-2022-49368: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49368 is a vulnerability discovered in the Linux kernel's MediaTek Ethernet SoC driver (mtk_eth_soc). The vulnerability involves an out-of-bounds read condition in the mtk_hwlro_get_fdir_entry() function, where the 'fsp->location' variable, which is user-controlled via ethtool_get_rxnfc(), could be used to access memory beyond the bounds of an array (NVD).

The vulnerability exists in the mtk_hwlro_get_fdir_entry() function of the MediaTek Ethernet SoC driver. The issue occurs because the function fails to validate the user-supplied 'fsp->location' variable before using it as an array index to access the hwlro_ip array. This could lead to an out-of-bounds read operation when accessing mac->hwlro_ip[fsp->location]. The vulnerability was introduced in commit 7aab747e5563 which added ethtool functions to configure RX flows of HW LRO (Kernel Commit).

The vulnerability allows an attacker to perform an out-of-bounds read operation, which could potentially lead to information disclosure from kernel memory. The impact is limited to systems using the MediaTek Ethernet SoC driver with hardware LRO (Large Receive Offload) functionality (NVD).

The vulnerability can be triggered through the ethtool_get_rxnfc() interface, which is accessible to users with sufficient privileges to use ethtool. The exploit requires the ability to pass a crafted location value that exceeds the bounds of the hwlro_ip array (Kernel Commit).

The vulnerability has been patched by adding a bounds check before accessing the array. The fix validates the fsp->location value against the array size using ARRAY_SIZE(mac->hwlro_ip) and returns -EINVAL if the value is out of bounds (Kernel Commit).