Linux Kernel Ethtool Coalesce Profile Update Vulnerability Allows User-Controlled Nesting

A vulnerability in the Linux kernel's ethtool component allows for improper handling of nested profile updates, specifically in the coalesce feature. The issue arises because the update function does not properly limit the index of nested entries, enabling user-controlled manipulation. This flaw can lead to memory management issues, as the destination buffer is duplicated based on a fixed number of entries, while the actual nested count can be freely controlled by the user. The vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability could result in memory corruption due to uncontrolled nesting of Netlink entries, potentially leading to arbitrary code execution or a denial-of-service condition.

Reproduction

To reproduce this vulnerability, send a Netlink message to the kernel with a nested list of profile updates for IRQ moderation. Ensure that the number of nested entries exceeds the expected limit, which is not properly enforced by the Netlink policy. This can be done by manually crafting a Netlink message that includes excessive nested profiles, taking advantage of the lack of constraints on the number of entries.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. The specific commit that addresses this issue is available in the Linux kernel stable tree.