CVE-2022-3107

What it actually does

Null pointer dereference in netvsc_get_ethtool_stats due to unchecked kvmalloc_array return value, resulting in kernel panic and denial of service.

Why it matters to the business

Unexpected system crashes and downtime on Linux hosts using Hyper-V virtual networking, requiring reboots and potentially disrupting workloads.

How an attack unfolds

A local attacker invokes ethtool statistics collection on a netvsc interface, triggering the unchecked allocation that returns NULL and causes an immediate kernel oops.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the unchecked kvmalloc_array return in drivers/net/hyperv/netvsc_drv.c.

How to confirm the fix worked

Confirm the kernel version is newer than the vulnerable range and verify that netvsc_get_ethtool_stats now checks the allocation result before use.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Identify or create a Hyper-V netvsc network interface
3. Execute ethtool -S or equivalent stats query against the interface
4. Trigger NULL dereference and kernel panic

How to detect it

Review kernel logs for oops or panic entries containing netvsc_get_ethtool_stats and kvmalloc_array; correlate with ethtool process executions on netvsc interfaces.

• netvsc_get_ethtool_stats
• kvmalloc_array
• netvsc_drv.c

What your security team should do

• Prioritize kernel updates on all Hyper-V Linux guest and host systems
• Monitor for kernel oops reports mentioning netvsc_drv
• Restrict local ethtool access via capabilities or SELinux where possible until patched