Executive brief
A vulnerability in the Linux kernel's network teaming driver could allow a local user to cause a system crash. The issue stems from improper validation of text-based configuration options, which can lead to the system reading uninitialized memory. This primarily impacts the availability of the affected system.
Technical details
A use of uninitialized resource (CWE-908) exists in the Linux kernel's team driver (drivers/net/team). The vulnerability occurs in team_nl_options_set_doit (or team_nl_cmd_options_set in some versions) when processing TEAM_OPTION_TYPE_STRING. The driver failed to ensure that user-provided string data was properly null-terminated before passing it to functions like vsnprintf. A local attacker with sufficient privileges to modify network team options can exploit this via Netlink to trigger an uninitialized value read, potentially leading to a kernel panic or denial of service. Patches have been released across multiple stable kernel branches to enforce null-byte validation.
Affected products
- Linux Linux Kernel 3.3 to 6.1.129, 6.2 to 6.6.79, 6.7 to 6.12.16, 6.13 to 6.13.4
Timeline
- 2025-02-12: patched: Initial patch authored by Eric Dumazet
- 2025-02-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/4236bf4716589558cc0f3c3612642b2c2141b04e
- https://git.kernel.org/stable/c/4512482e4805dd30bc77dec511f2a2edba5cb868
- https://git.kernel.org/stable/c/5bef3ac184b5626ea62385d6b82a1992b89d7940
- https://git.kernel.org/stable/c/7c30483d0f6bdb2230e10e3e4be5167927eac7a0
- https://git.kernel.org/stable/c/7f5af50f3aa0af8cbef9fb76fffeed69e8143f59
- https://git.kernel.org/stable/c/8401cade1918281177974b32c925afdce750d292
- https://git.kernel.org/stable/c/d071a91fa614ecdf760c29f61f6a7bfb7df796d6