Lucene search

K
vulnrichmentLinuxVULNRICHMENT:CVE-2021-47556
HistoryMay 24, 2024 - 3:09 p.m.

CVE-2021-47556 ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()

2024-05-2415:09:57
Linux
github.com
1
linux
kernel
ethtool
vulnerability
fix
driver options

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

In the Linux kernel, the following vulnerability has been resolved:

ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()

ethtool_set_coalesce() now uses both the .get_coalesce() and
.set_coalesce() callbacks. But the check for their availability is
buggy, so changing the coalesce settings on a device where the driver
provides only one of the callbacks results in a NULL pointer
dereference instead of an -EOPNOTSUPP.

Fix the condition so that the availability of both callbacks is
ensured. This also matches the netlink code.

Note that reproducing this requires some effort - it only affects the
legacy ioctl path, and needs a specific combination of driver options:

  • have .get_coalesce() and .coalesce_supported but no
    .set_coalesce(), or
  • have .set_coalesce() but no .get_coalesce(). Here eg. ethtool doesn’t
    cause the crash as it first attempts to call ethtool_get_coalesce()
    and bails out on error.

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial