CVE-2022-49368: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49368 is a vulnerability discovered in the Linux kernel's MediaTek Ethernet SoC driver (mtkethsoc). The vulnerability involves an out-of-bounds read condition in the mtkhwlrogetfdirentry() function, where the 'fsp->location' variable, which is user-controlled via ethtoolgetrxnfc(), could be used to access memory beyond the bounds of an array (NVD).

The vulnerability exists in the mtkhwlrogetfdirentry() function of the MediaTek Ethernet SoC driver. The issue occurs because the function fails to validate the user-supplied 'fsp->location' variable before using it as an array index to access the hwlroip array. This could lead to an out-of-bounds read operation when accessing mac->hwlroip[fsp->location]. The vulnerability was introduced in commit 7aab747e5563 which added ethtool functions to configure RX flows of HW LRO (Kernel Commit).

The vulnerability allows an attacker to perform an out-of-bounds read operation, which could potentially lead to information disclosure from kernel memory. The impact is limited to systems using the MediaTek Ethernet SoC driver with hardware LRO (Large Receive Offload) functionality (NVD).

The vulnerability has been patched by adding a bounds check before accessing the array. The fix validates the fsp->location value against the array size using ARRAYSIZE(mac->hwlroip) and returns -EINVAL if the value is out of bounds (Kernel Commit).