CVE-2023-53798: In the Linux kernel, the following vulnerability has been resolved: ethtool: Fix uninitialized number of lanes It is not possible to set the number of lanes…

PriorityP421low5.5

EPSS

0.19%

9.4th percentile

In the Linux kernel, the following vulnerability has been resolved: ethtool: Fix uninitialized number of lanes It is not possible to set the number of lanes when setting link modes using the legacy IOCTL ethtool interface. Since 'struct ethtool_link_ksettings' is not initialized in this path, drivers receive an uninitialized number of lanes in 'struct ethtool_link_ksettings::lanes'. When this information is later queried from drivers, it results in the ethtool code making decisions based on uninitialized memory, leading to the following KMSAN splat [1]. In practice, this most likely only happens with the tun driver that simply returns whatever it got in the set operation. As far as I can tell, this uninitialized memory is not leaked to user space thanks to the 'ethtool_ops->cap_link_lanes_supported' check in linkmodes_prepare_data(). Fix by initializing the structure in the IOCTL path. Did not find any more call sites that pass an uninitialized structure when calling 'ethtool_ops::set_link_ksettings()'. [1] BUG: KMSAN: uninit-value in ethnl_update_linkmodes net/ethtool/linkmodes.c:273 [inline] BUG: KMSAN: uninit-value in ethnl_set_linkmodes+0x190b/0x19d0 net/ethtool/linkmodes.c:333 ethnl_update_linkmodes net/ethtool/linkmodes.c:273 [inline] ethnl_set_linkmodes+0x190b/0x19d0 net/ethtool/linkmodes.c:333 ethnl_default_set_doit+0x88d/0xde0 net/ethtool/netlink.c:640 genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] genl_rcv_msg+0x141a/0x14c0 net/netlink/genetlink.c:1065 netlink_rcv_skb+0x3f8/0x750 net/netlink/af_netlink.c:2577 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0xf41/0x1270 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x127d/0x1430 net/netlink/af_netlink.c:1942 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501 ___sys_sendmsg+0x

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.37-1 (bookworm)	linux 6.1.37-1 (bookworm)
linux	linux	—	—
linux	linux	>= 012ce4dd3102a0f4d80167de343e9d44b257c1b8 < da81af0ef8092ecacd87fac3229c29e2e0ce39fd	da81af0ef8092ecacd87fac3229c29e2e0ce39fd
linux	linux	>= 012ce4dd3102a0f4d80167de343e9d44b257c1b8 < 942a2a0184f7bb1c1ae4bbc556559c86c054b0d2	942a2a0184f7bb1c1ae4bbc556559c86c054b0d2
linux	linux	>= 012ce4dd3102a0f4d80167de343e9d44b257c1b8 < 6456d80045d6de47734b1a3879c91f72af186529	6456d80045d6de47734b1a3879c91f72af186529
linux	linux	>= 012ce4dd3102a0f4d80167de343e9d44b257c1b8 < 72808c4ab5fd01bf1214195005e15b434bf55cef	72808c4ab5fd01bf1214195005e15b434bf55cef
linux	linux	>= 012ce4dd3102a0f4d80167de343e9d44b257c1b8 < 9ad685dbfe7e856bbf17a7177b64676d324d6ed7	9ad685dbfe7e856bbf17a7177b64676d324d6ed7
linux	linux_kernel	>= 0 < 6.1.37-1	6.1.37-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 5.12.0 < 5.15.112	5.15.112
linux	linux_kernel	>= 5.16.0 < 6.1.29	6.1.29
linux	linux_kernel	>= 6.2.0 < 6.2.16	6.2.16
linux	linux_kernel	>= 6.3.0 < 6.3.3	6.3.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.