Linux Kernel Netlink EEPROM Handling Vulnerability

A vulnerability in the Linux kernel's handling of EEPROM data via Netlink has been addressed. The issue arose in the Netlink fallback method for reading module EEPROM, which failed to properly validate the length of data being read. Specifically, while the method checked that the offset was within bounds, it did not ensure that the combination of offset and length remained within the total length of the EEPROM data. This oversight could lead to unexpected behavior in device drivers and firmware. The problem has been corrected by adding the necessary validation to the Netlink fallback method, aligning it with the existing safeguards in the ioctl equivalent. Additionally, the update ensures that all buffers sent to drivers are properly initialized to prevent any unintentional data exposure.

Impact

The vulnerability could cause incorrect data handling in device drivers and firmware, potentially leading to unexpected behavior or errors.

Reproduction

The vulnerability can be reproduced by using the Netlink command to read module EEPROM without the proper length validation. This can be done by specifying an offset and length that exceed the bounds of the EEPROM data, which will lead to an error or unexpected behavior in the driver or device firmware.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version can be found in the Linux kernel documentation.