ethtool: cmis: validate start_cmd_payload_size from module
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.93, 6.18.35, 7.0.12
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate start_cmd_payload_size from module The CMIS firmware update code reads start_cmd_payload_size from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination buffer is 112 bytes (ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious module (or corrupted response) can cause a OOB write later on in cmis_fw_update_start_download(). Let's error out. If modules that expect longer LPL writes actually exist we should revisit. struct cmis_cdb_start_fw_download_pl's definition has to move, no change there.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From c4f78134d45c9619339c96b4bea380b1d0699788 · fixed in 63112b4515469d00008452d9cfe3fb3bf1aa2df3; From c4f78134d45c9619339c96b4bea380b1d0699788 · fixed in 0696709e951be54c699664adf546d16e28974d53; From c4f78134d45c9619339c96b4bea380b1d0699788 · fixed in a46340da00385be7fb16c62425ebc20006f2d5d8; From c4f78134d45c9619339c96b4bea380b1d0699788 · fixed in 12c2496a71f82f63617971ca9b730dffa05cf58b
- Linux Linux
6.11
- KernelLinux
From 6.11.0 · fixed in 6.12.93; From 6.13.0 · fixed in 6.18.35; From 6.19.0 · fixed in 7.0.12