Linux Kernel igc Driver Buffer Type Mismanagement Vulnerability for SMD Frames

A vulnerability exists in the Linux kernel's igc driver, specifically in the handling of SMD (Service Management Data) frames. The issue arises because the function responsible for initializing SMD frames does not properly set the transmission buffer type, leaving it open to potential mismanagement. This can lead to incorrect processing of transmission completions, as the buffer type is reused and a stale type can interfere with the proper cleanup process. The vulnerability affects the stable versions of the Linux kernel.

Impact

The vulnerability can cause transmission completion processes to use incorrect cleanup paths, potentially leading to undefined behavior or data corruption.

Reproduction

The vulnerability can be reproduced by initializing an SMD frame using the igc_fpe_init_smd_frame() function. This function will populate the igc_tx_buffer fields for the SMD socket buffer (skb) but will omit setting the buffer type. As a result, the transmission buffer type may remain stale, allowing an incorrect type to persist and disrupt the transmission completion process.

Remediation

The vulnerability has been addressed by updating the igc_fpe_init_smd_frame() function to include the correct buffer type for SMD frames. Users should apply the latest patches available in the Linux kernel stable tree to mitigate this issue.