ethtool: Potential NULL Dereference in ethtool_set_coalesce()
Summary
GSD-2021-1002543: ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce(). Affects Kernel versions >= f3ccfda1931977b80267ba54070a1aeafa18f6ca, < abfdd9e2f0f9699015d72317f74154d3e53664e6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ethtool package is a command-line utility used for configuring network interfaces in Linux systems. It provides various options to view and modify the settings of network devices. The ethtool_set_coalesce() function is responsible for setting the coalescing parameters for a network interface, which determines how packets are aggregated before being processed by the system. This vulnerability affects the ethtool package in the Linux Kernel.
Vulnerability Detail
The ethtool_set_coalesce() function in the ethtool package is susceptible to a potential NULL dereference. This vulnerability can be triggered when a user supplies a malicious input, leading to a NULL pointer dereference and resulting in a kernel crash or potential privilege escalation. An attacker with local access to the system may be able to exploit this vulnerability to gain elevated privileges or disrupt the normal operation of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround available for this vulnerability. It is recommended to apply the official fix by updating the Linux Kernel to the latest version.
Conclusion
The ethtool package in the Linux Kernel is vulnerable to a potential NULL dereference in the ethtool_set_coalesce() function. This vulnerability can be exploited by an attacker with local access to the system to gain elevated privileges or disrupt the normal operation of the system. It is recommended to update the Linux Kernel to version v5.15.6 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ethtool is a command-line utility used for configuring network interfaces in Linux systems. It provides various options to view and modify the settings of network devices.
This vulnerability can lead to a NULL pointer dereference in the ethtool package, potentially resulting in a kernel crash or privilege escalation. An attacker with local access to the system may be able to exploit this vulnerability to gain elevated privileges or disrupt the normal operation of the system.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.6 or later. The fix for this issue was implemented in commit abfdd9e2f0f9699015d72317f74154d3e53664e6.
There is no known workaround available for this vulnerability. It is recommended to apply the official fix by updating the Linux Kernel to the latest version.
This vulnerability requires local access to the system to be exploited. Remote exploitation is not possible unless an attacker already has privileged access to the target system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
