Threats Tagged 'ghsa-fv49-mrx3-2jvj'

A vulnerability in the Linux kernel's ethtool utility could cause a userspace buffer overflow during statistics queries if the number of stats changes between ioctl calls. This occurs because ethtool's -S command uses multiple ioctl calls to retrieve stats size, names, and values, and dynamic stat counters in some drivers can cause mismatches leading to incorrect buffer allocation. The issue has been addressed by modifying ethtool functions to return zero stats when a size mismatch is detected, preventing buffer overflow and resulting in either no stats output or all-zero stats temporarily. This fix does not eliminate the underlying race condition but prevents overflow and improves behavior predictability.