Linux Kernel Out-of-Bounds Write Vulnerability in Ethtool CMIS CDB Reply Length Handling

A vulnerability in the Linux kernel's handling of CDB replies in the ethtool CMIS module can lead to out-of-bounds writes. This issue arises because a malicious or faulty SFP module could send a reply length longer than what the kernel expects, potentially overwriting memory and causing instability. While the threat from malicious hardware is theoretical, some modules could be buggy or misread, making this a valid concern. The vulnerability affects the Linux kernel stable tree.

Impact

The vulnerability can be exploited to cause out-of-bounds writes, which can lead to memory corruption and potentially allow for arbitrary code execution or escalation of privileges.

Reproduction

The vulnerability can be reproduced by using an SFP module that either responds with an exaggerated reply length or one that is known to be faulty, in conjunction with a version of the Linux kernel that is prior to the patch.

Remediation

Users can upgrade to the latest version of the Linux kernel stable tree to address this vulnerability.