In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: bcmgenet: fix NULL dereference in set_coalesce before first open<\/p>\n
The Rx ring priv and index are only set in bcmgenet_init_rx_ring(),
\nwhich runs at open. Setting the Rx coalescing parameters on an interface
\nthat was never opened, e.g. “ethtool -C eth0 rx-usecs 50”, dereferences
\na NULL ring->priv. The oops happens with RTNL held, so networking
\nstays stuck until a reboot:<\/p>\n
Unable to handle kernel paging request at virtual address 0000000000002788
\n pc : bcmgenet_set_rx_coalesce.isra.0+0x10\/0x88
\n lr : bcmgenet_set_coalesce+0xe8\/0x180
\n Call trace:
\n bcmgenet_set_rx_coalesce.isra.0+0x10\/0x88 (P)
\n __ethnl_set_coalesce.isra.0+0x490\/0x570
\n ethnl_set_coalesce+0x48\/0xc0
\n ethnl_default_set_doit+0xf4\/0x230
\n genl_family_rcv_msg_doit+0xe8\/0x160
\n genl_rcv_msg+0x220\/0x2a0
\n netlink_rcv_skb+0x68\/0x140
\n genl_rcv+0x40\/0x60
\n netlink_unicast+0x338\/0x3c0
\n netlink_sendmsg+0x19c\/0x3f8
\n __sock_sendmsg+0x64\/0xc0
\n __sys_sendto+0x124\/0x198
\n __arm64_sys_sendto+0x30\/0x48<\/p>\n
Set priv and index at probe. Writing the registers while the interface
\nis down is harmless because open resets the MAC and
\nbcmgenet_init_rx_coalesce() reapplies the stored values.<\/p>\n
It was observed on a Raspberry Pi CM4, but should apply to all other
\ngenet devices.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: bcmgenet: fix NULL dereference in set_coalesce before first open<\/p>\n
The Rx ring priv and index are only set in bcmgenet_init_rx_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41270","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41270","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41270"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41270"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41270"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}