Linux Kernel Airoha Ethernet Driver Uninitialized Fragment Read Vulnerability

A vulnerability exists in the Linux kernel's Airoha Ethernet driver, specifically in the fragment transmission loop of the 'airoha_dev_xmit' function. During the final iteration of the loop, the function reads fragment addresses and lengths when the loop index matches the number of fragments. At this point, the fragment data is uninitialized, creating a risk of an unsafe read that could trigger a page fault. Although the uninitialized data is not used, the read operation itself poses a potential risk. This vulnerability affects the Linux kernel stable tree.

Impact

The vulnerability could lead to a page fault, causing a denial of service by crashing the system or application that is handling the network transmission.

Reproduction

The vulnerability can be reproduced by transmitting a network packet that includes fragment data through the Airoha Ethernet driver. During the last iteration of the transmission loop, the driver will incorrectly read uninitialized fragment data, which can cause a page fault and disrupt normal operation.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. The specific commit that resolves this issue is available in the Linux kernel stable tree.