CVE-2023-54156

What it actually does

Null pointer dereference in efx_nic_update_stats during efx_net_stats when nic_data->mc_stats is NULL due to concurrent NIC reset and missing stats_lock protection, allowing a TOCTTOU race.

Why it matters to the business

Kernel panic and system crash on Linux hosts using affected SFC Ethernet drivers during stats collection or selftests, leading to service interruption and requiring reboots with potential loss of in-flight work.

How an attack unfolds

An attacker with local access triggers ethtool selftest or repeated stats queries while the NIC is being reset, causing the unprotected stats fetch path to dereference a NULL pointer and panic the kernel.

How to fix it

Upgrade the Linux kernel to the fixed commit cb1aa7cc562cab6a87ea33574c8c65f2d2fd7aeb or a later stable release that adds the stats_lock in fini_nic and the NULL guard in the stats path.

How to confirm the fix worked

Confirm the running kernel contains commit cb1aa7cc562cab6a87ea33574c8c65f2d2fd7aeb, then exercise ethtool -t and stats collection during simulated resets to verify absence of NULL dereference oops.

Typical attack path

1. Obtain local shell or process execution on the target host
2. Initiate network device selftest or stats polling via ethtool or procfs while the SFC NIC reset path runs
3. Trigger the race that leaves mc_stats NULL during efx_ef10_update_stats_pf
4. Cause kernel NULL dereference and system crash

How to detect it

Search kernel logs and dmesg for oops or panic messages containing efx_nic_update_stats, efx_ef10_update_stats_pf, or NULL pointer dereference at address 0000000000000038 in the SFC driver path.

What your security team should do

• Prioritize kernel upgrade on all systems exposing the SFC driver
• Enable kernel panic logging and watchdog reboots for rapid recovery
• Restrict unprivileged ethtool access via capabilities or SELinux until patched