CVE-2023-53142

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ice: copy last block omitted in ice_get_module_eeprom()

ice_get_module_eeprom() is broken since commit e9c9692c8a81 ("ice:

Reimplement module reads used by ethtool") In this refactor,

ice_get_module_eeprom() reads the eeprom in blocks of size 8.

But the condition that should protect the buffer overflow

ignores the last block. The last block always contains zeros.

Bug uncovered by ethtool upstream commit 9538f384b535

("netlink: eeprom: Defer page requests to individual parsers")

After this commit, ethtool reads a block with length = 1;

to read the SFF-8024 identifier value.

unpatched driver:

$ ethtool -m enp65s0f0np0 offset 0x90 length 8

Offset Values

------ ------

0x0090: 00 00 00 00 00 00 00 00

$ ethtool -m enp65s0f0np0 offset 0x90 length 12

Offset Values

------ ------

0x0090: 00 00 01 a0 4d 65 6c 6c 00 00 00 00

$

$ ethtool -m enp65s0f0np0

Offset Values

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References