Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 5.15.0-rc6+
Description:
The issue is related to the ethtool component of the Linux kernel, where there is a short period between a net device starting to be unregistered and when it is actually gone, during which ethtool operations could still be performed, potentially leading to unwanted or undefined behaviors. This could result in NULL pointer exceptions and use-after-free errors. For example, adding Tx queues after unregistering a net device could lead to such errors.
Recommendations:
To resolve the issue, update the Linux kernel to a version that includes the patch for this vulnerability.
As a temporary workaround, consider disabling ethtool operations on net devices that are being unregistered to minimize the risk of exploitation.
Restrict access to the netlink part of the ethtool component, as the ioctl part is not affected by this issue.