ethtool: eeprom: add more safeties to EEPROM Netlink fallback
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.8epss 0.2%
probabilidad de explotación
0.2%top 93% de las CVE
explotación observada
noninguna fuente lo reporta
In the Linux kernel, the following vulnerability has been resolved:
ethtool: eeprom: add more safeties to EEPROM Netlink fallback
The Netlink fallback path for reading module EEPROM
(fallback_set_params()) validates that offset < eeprom_len,
but does not check that offset + length stays within eeprom_len.
The ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has
always enforced both bounds:
if (eeprom.offset + eeprom.len > total_len)
return -EINVAL;
This could lead to surprises in both drivers and device FW.
Add the missing offset + length validation to fallback_set_params(),
mirroring the ioctl.
Similarly - ethtool core in general, and ethtool_get_any_eeprom()
in particular tries to zero-init all buffers passed to the drivers
to avoid any extra work of zeroing things out. eeprom_fallback()
uses a plain kmalloc(), change it to zalloc.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Linux · LinuxReferencias
https://git.kernel.org/stable/c/0e182689831277faf2ef683573a60474c208f690https://git.kernel.org/stable/c/4fe1bc4b3603f621240d5b401742f302190db769https://git.kernel.org/stable/c/65674d2489a12b8efd2ca0effb3de1d12224b596https://git.kernel.org/stable/c/67cfdd9210b99f260b3e0afeb9525e0acc7be31ehttps://git.kernel.org/stable/c/6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1https://git.kernel.org/stable/c/d81376053a00865c70b8d8506a1cb93f2943d413https://git.kernel.org/stable/c/fd0de51c54fa8474a0ddeedd71c65ad09fada390