Executive brief
A vulnerability in the Linux kernel's Realtek network driver could allow a local user to cause a system crash. The issue occurs when specific Realtek network hardware (RTL8125) attempts to write diagnostic data into a memory area that is too small, potentially overwriting unrelated system memory. This primarily impacts the stability and availability of the affected system.
Technical details
A vulnerability exists in the r8169 network driver within the Linux kernel due to insufficient memory allocation for tally counters on RTL8125 hardware. The RTL8125 chip introduced additional fields to the tally counter structure that were not accounted for in the driver's memory allocation logic. When the hardware performs a Direct Memory Access (DMA) transfer of these counters, it may write beyond the allocated buffer into unallocated or adjacent memory. A local attacker with sufficient privileges to trigger counter updates could potentially cause a kernel oops or system instability (denial of service). The issue has been resolved by updating the 'rtl8169_counters' structure to include all fields supported by the RTL8125.
Affected products
- Linux Linux Kernel 5.4 to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.55, 6.7 to 6.10.14, 6.11 to 6.11.3
Timeline
- 2024-10-21: disclosed
- 2024-10-21: advisory
- 2024-10-10: patched: Patch committed to stable branches.
References
- https://git.kernel.org/stable/c/1c723d785adb711496bc64c24240f952f4faaabf
- https://git.kernel.org/stable/c/21950321ad33d7613b1453f4c503d7b1871deb61
- https://git.kernel.org/stable/c/585c048d15ed559f20cb94c8fa2f30077efa4fbc
- https://git.kernel.org/stable/c/64648ae8c97ec5a3165021627f5a1658ebe081ca
- https://git.kernel.org/stable/c/92bc8647b4d65f4d4bf8afdb206321c1bc55a486
- https://git.kernel.org/stable/c/991e8b0bab669b7d06927c3e442b3352532e8581
- https://git.kernel.org/stable/c/ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a