In the Linux kernel, the following vulnerability has been resolved:
ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
ethtool_set_coalesce() now uses both the .get_coalesce() and .set_coalesce() callbacks. But the check for their availability is buggy, so changing the coalesce settings on a device where the driver provides only _one_ of the callbacks results in a NULL pointer dereference instead of an -EOPNOTSUPP.
Fix the condition so that the availability of both callbacks is ensured. This also matches the netlink code.
Note that reproducing this requires some effort - it only affects the legacy ioctl path, and needs a specific combination of driver options: - have .get_coalesce() and .coalesce_supported but no .set_coalesce(), or - have .set_coalesce() but no .get_coalesce(). Here eg. ethtool doesn't cause the crash as it first attempts to call ethtool_get_coalesce() and bails out on error.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 24, 2024 |
| Suse | — | Upgrade dtb-allwinnerUpgrade dtb-apmUpgrade kernel-source-rtUpgrade kernel-obs-qaUpgrade dtb-amazonUpgrade kernel-kvmsmallUpgrade kselftests-kmp-64kbUpgrade kernel-64kbUpgrade dtb-appleUpgrade kernel-syms-rtUpgrade cluster-md-kmp-azureUpgrade dtb-alteraUpgrade dlm-kmp-defaultUpgrade dtb-exynosUpgrade cluster-md-kmp-defaultUpgrade kernel-macrosUpgrade kernel-64kb-optionalUpgrade kernel-64kb-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-devel-azureUpgrade kernel-docs-htmlUpgrade dlm-kmp-64kbUpgrade dtb-hisiliconUpgrade ocfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-default-develUpgrade kernel-azure-optionalUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-develUpgrade dtb-freescaleUpgrade gfs2-kmp-rtUpgrade kernel-develUpgrade kernel-kvmsmall-livepatch-develUpgrade gfs2-kmp-64kbUpgrade dtb-marvellUpgrade reiserfs-kmp-defaultUpgrade dtb-xilinxUpgrade kernel-debugUpgrade dtb-lgUpgrade kernel-azure-extraUpgrade dtb-broadcomUpgrade kernel-rt_debug-develUpgrade kernel-default-baseUpgrade kernel-64kb-develUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-sourceUpgrade kernel-zfcpdumpUpgrade ocfs2-kmp-64kbUpgrade kernel-debug-develUpgrade dtb-renesasUpgrade dtb-amdUpgrade dtb-socionextUpgrade kernel-rt_debugUpgrade reiserfs-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-default-livepatch-develUpgrade kernel-symsUpgrade kernel-source-azureUpgrade kernel-defaultUpgrade cluster-md-kmp-64kbUpgrade dtb-amlogicUpgrade gfs2-kmp-azureUpgrade kernel-default-base-rebuildUpgrade dtb-sprdUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-azure-develUpgrade dtb-mediatekUpgrade kernel-rt-livepatchUpgrade kernel-rtUpgrade kernel-source-vanillaUpgrade dlm-kmp-azureUpgrade dtb-qcomUpgrade kernel-debug-livepatch-develUpgrade kernel-syms-azureUpgrade kselftests-kmp-rtUpgrade kernel-default-vdsoUpgrade kernel-obs-buildUpgrade dtb-armUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-azureUpgrade kernel-rt-optionalUpgrade kernel-default-optionalUpgrade kernel-64kb-extraUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-docsUpgrade kernel-rt-develUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-rt-extraUpgrade dtb-nvidiaUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-livepatch-develUpgrade kselftests-kmp-azureUpgrade dtb-caviumUpgrade dtb-rockchipUpgrade kernel-debug-vdso | Aug 9, 2024 | May 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub