Executive brief
The Linux kernel's Marvell PPv2 Ethernet driver contains a buffer overflow vulnerability in its ethtool network configuration interface. An attacker with local access can trigger an out-of-bounds memory write by passing a malicious rule count parameter, potentially leading to kernel memory corruption, denial of service, or privilege escalation.
Technical details
The mvpp2_ethtool_get_rxnfc() function in drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c allocates a rules buffer with a size determined by user-supplied rule_cnt parameter. The function fails to validate rule_cnt before writing to the rules array in the ETHTOOL_GRXCLSRLALL code path, allowing an out-of-bounds write or NULL pointer dereference. The vulnerability occurs when iterating through RFS entries and writing to rules[loc++] without checking if loc exceeds the allocated buffer size. The fix adds a bounds check: if (loc == info->rule_cnt) { ret = -EMSGSIZE; break; }. This is a local privilege escalation vector requiring user-space access to ethtool interface.
Affected products
- Linux Linux kernel multiple versions (see upstream fix for affected ranges)
Timeline
- 2023-09-08: disclosed: Fix committed upstream
- 2023-09-11: patched: Merged into mainline
- 2023-09-19: other: Backported to stable kernels