CVE-2023-53798

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ethtool: Fix uninitialized number of lanes

It is not possible to set the number of lanes when setting link modes

using the legacy IOCTL ethtool interface. Since 'struct

ethtool_link_ksettings' is not initialized in this path, drivers receive

an uninitialized number of lanes in 'struct

ethtool_link_ksettings::lanes'.

When this information is later queried from drivers, it results in the

ethtool code making decisions based on uninitialized memory, leading to

the following KMSAN splat [1]. In practice, this most likely only

happens with the tun driver that simply returns whatever it got in the

set operation.

As far as I can tell, this uninitialized memory is not leaked to user

space thanks to the 'ethtool_ops->cap_link_lanes_supported' check in

linkmodes_prepare_data().

Fix by initializing the structure in the IOCTL path. Did not find any

more call sites that pass an uninitialized structure when calling

'ethtool_ops:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References