Description
In the Linux kernel, the following vulnerability has been resolved: ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path for reading module EEPROM (fallback_set_params()) validates that offset < eeprom_len, but does not check that offset + length stays within eeprom_len. The ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has always enforced both bounds: if (eeprom.offset + eeprom.len > total_len) return -EINVAL; This could lead to surprises in both drivers and device FW. Add the missing offset + length validation to fallback_set_params(), mirroring the ioctl. Similarly - ethtool core in general, and ethtool_get_any_eeprom() in particular tries to zero-init all buffers passed to the drivers to avoid any extra work of zeroing things out. eeprom_fallback() uses a plain kmalloc(), change it to zalloc.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
96d971e307cc0e434f96329b42bbd98cfbca07d2 to < 0e182689831277faf2ef683573a60474c208f690affected96d971e307cc0e434f96329b42bbd98cfbca07d2 to < 6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1affected96d971e307cc0e434f96329b42bbd98cfbca07d2 to < 65674d2489a12b8efd2ca0effb3de1d12224b596affected96d971e307cc0e434f96329b42bbd98cfbca07d2 to < d81376053a00865c70b8d8506a1cb93f2943d413affected96d971e307cc0e434f96329b42bbd98cfbca07d2 to < fd0de51c54fa8474a0ddeedd71c65ad09fada390affected96d971e307cc0e434f96329b42bbd98cfbca07d2 to < 4fe1bc4b3603f621240d5b401742f302190db769affected96d971e307cc0e434f96329b42bbd98cfbca07d2 to < 67cfdd9210b99f260b3e0afeb9525e0acc7be31eaffected
Linux Linux
Default version status: affected
5.13affected0 to < 5.13unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.93 to ≤ 6.12.*unaffected6.18.35 to ≤ 6.18.*unaffected7.0.12 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0e182689831277faf2ef683573a60474c208f690 ↗
- https://git.kernel.org/stable/c/6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1 ↗
- https://git.kernel.org/stable/c/65674d2489a12b8efd2ca0effb3de1d12224b596 ↗
- https://git.kernel.org/stable/c/d81376053a00865c70b8d8506a1cb93f2943d413 ↗
- https://git.kernel.org/stable/c/fd0de51c54fa8474a0ddeedd71c65ad09fada390 ↗
- https://git.kernel.org/stable/c/4fe1bc4b3603f621240d5b401742f302190db769 ↗
- https://git.kernel.org/stable/c/67cfdd9210b99f260b3e0afeb9525e0acc7be31e ↗