Linux Kernel Out-of-Bounds Write Vulnerability in Ethtool CMIS Firmware Update Handling

A vulnerability has been identified in the Linux kernel's handling of CMIS firmware updates via ethtool. The issue arises because the firmware update code directly uses the 'start_cmd_payload_size' from the module's CDB reply as the byte count for memory copying. This can lead to an out-of-bounds write, as the destination buffer has a maximum length of 112 bytes. A malicious module or a corrupted response could exploit this flaw, potentially causing memory corruption or other unintended behavior.

Impact

Exploitation of this vulnerability leads to an out-of-bounds write, which can commonly result in memory corruption or arbitrary code execution.

Reproduction

The vulnerability can be reproduced by using a malicious module that sends a crafted CDB response with a 'start_cmd_payload_size' value exceeding the maximum payload length expected by the CMIS firmware update handler. This will trigger the out-of-bounds write when the firmware update process attempts to copy the payload into the destination buffer.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for updating the kernel can be found in the official Linux documentation or through the package management system of the respective Linux distribution.