Executive brief
A vulnerability in the Linux kernel's networking driver for STMicroelectronics Ethernet controllers could allow a local user to crash the system. The issue occurs when disabling certain traffic control features, leading to a mathematical error that halts the processor. This results in a denial-of-service, impacting system availability and potentially disrupting network operations.
Technical details
A division-by-zero vulnerability exists in the stmmac Ethernet driver within the Linux kernel, specifically in the tc_setup_cbs function. A previous commit allowed the 'port_transmit_rate_kbps' variable to be set to zero when offloading is disabled; this zero value is subsequently passed to the 'div_s64' function when the Credit-Based Shaper (CBS) is being disabled. An attacker with local privileges could trigger this condition by manipulating traffic control settings, resulting in a kernel panic or oops. The fix introduces an early return statement after setting the transmit queue mode to DCB when CBS is disabled, bypassing the unnecessary and dangerous calculation. Patches have been released for multiple stable kernel branches including 5.10, 5.15, 6.1, 6.6, 6.10, and 6.11.
Affected products
- Linux Linux kernel 5.10.221 to 5.10.227, 5.15.162 to 5.15.168, 6.1.96 to 6.1.113, 6.6.36 to 6.6.55, 6.9.7 to 6.10, 6.10 to 6.10.14, 6.11 to 6.11.3
Timeline
- 2024-10-21: disclosed
- 2024-10-21: advisory
References
- https://git.kernel.org/stable/c/03582f4752427f60817d896f1a827aff772bd31e
- https://git.kernel.org/stable/c/5d43e1ad4567d67af2b42d3ab7c14152ffed25c6
- https://git.kernel.org/stable/c/675faf5a14c14a2be0b870db30a70764df81e2df
- https://git.kernel.org/stable/c/837d9df9c0792902710149d1a5e0991520af0f93
- https://git.kernel.org/stable/c/b0da9504a528f05f97d926b4db74ff21917a33e9
- https://git.kernel.org/stable/c/e297a2bf56d12fd7f91a0c209eb6ea84361f3368
- https://git.kernel.org/stable/c/e33fe25b1efe4f2e6a5858786dbc82ae4c44ed4c