CVE-2021-47556: ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
In the Linux kernel, the following vulnerability has been resolved:
ethtool: ioctl: fix potential NULL deref in ethtoolsetcoalesce()
ethtoolsetcoalesce() now uses both the .getcoalesce() and .setcoalesce() callbacks. But the check for their availability is buggy, so changing the coalesce settings on a device where the driver provides only one of the callbacks results in a NULL pointer dereference instead of an -EOPNOTSUPP.
Fix the condition so that the availability of both callbacks is ensured. This also matches the netlink code.
Note that reproducing this requires some effort - it only affects the legacy ioctl path, and needs a specific combination of driver options: - have .getcoalesce() and .coalescesupported but no .setcoalesce(), or - have .setcoalesce() but no .getcoalesce(). Here eg. ethtool doesn't cause the crash as it first attempts to call ethtoolgetcoalesce() and bails out on error.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47556?
CVE-2021-47556 has a medium severity rating due to the potential for NULL dereference.
How do I fix CVE-2021-47556?
To fix CVE-2021-47556, update the Linux kernel to version 5.15.6 or higher.
Which versions of the Linux kernel are affected by CVE-2021-47556?
CVE-2021-47556 affects Linux kernel versions from 5.15 to below 5.15.6.
What component is impacted by CVE-2021-47556?
CVE-2021-47556 impacts the ethtool component of the Linux kernel.
Is CVE-2021-47556 a local or remote vulnerability?
CVE-2021-47556 is considered a local vulnerability, as it requires local access to the affected system.