CVE-2021-47556

ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()

published May 24, 2024

CVSS
—
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()

ethtool_set_coalesce() now uses both the .get_coalesce() and

.set_coalesce() callbacks. But the check for their availability is

buggy, so changing the coalesce settings on a device where the driver

provides only _one_ of the callbacks results in a NULL pointer

dereference instead of an -EOPNOTSUPP.

Fix the condition so that the availability of both callbacks is

ensured. This also matches the netlink code.

Note that reproducing this requires some effort - it only affects the

legacy ioctl path, and needs a specific combination of driver options:

- have .get_coalesce() and .coalesce_supported but no

.set_coalesce(), or

- have .set_coalesce() but no .get_coalesce(). Here eg. ethtool doesn't

cause the crash as it first attempts to call ethtool_get_coalesce()

and bails out on error.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00183 · 7.5th percentile
Published
2024-05-24T15:09Z
EPSS history
Timeline
  • 24 MAY 15:09Z
    ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
    cvelistv5