Linux Kernel Cortina Ethernet Driver Race Condition Vulnerability in Gemini Gigabit Ethernet

A vulnerability has been addressed in the Linux kernel's Cortina Ethernet driver for Gemini gigabit Ethernet. The issue arose because the socket buffer (SKB) used to assemble packets from fragments in the receive function was a static local variable. This design flaw could lead to race conditions when both Ethernet ports were used simultaneously. The vulnerability has been fixed by making the RX SKB a per-port variable, allowing it to be carried over between function invocations in the port structure. The patch also includes measures to reset the SKB pointer appropriately under certain conditions, such as errors or when the port is stopped.

Impact

The vulnerability could cause race conditions between the two Ethernet ports on a Gemini device, potentially leading to data corruption or packet loss.

Reproduction

The vulnerability can be reproduced by using a device with Gemini gigabit Ethernet that actively employs both Ethernet ports. This usage can trigger race conditions due to the static local variable design of the SKB in the receive function, gmac_rx().

Remediation

Users can apply the available patch to address this vulnerability. The patch is included in the official Linux kernel stable tree.