Vulnerability in Linux

CVE-2023-54240

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() rule_locs is allocated in ethtool_get_rxnfc and the size is determined by rule_cnt from user space. So rule_cnt needs to be check before using rule_locs to avoid NULL pointer dereference.

EPSS: 0.002 (7.5th percentile) — read the EPSS interpretation.

Affected products

  • Linux — versions 7aab747e5563ecbc9f3cb64ddea13fe7b9fee2bd, 4.9, 0

References