CVE-2023-54240

What it actually does

NULL pointer dereference in mtk_hwlro_get_fdir_all when rule_locs allocation size derived from untrusted user-space rule_cnt is zero or leads to failed allocation, allowing dereference of NULL buffer during ethtool RXNFC handling.

Why it matters to the business

Kernel crash or denial-of-service on affected Linux systems using MediaTek Ethernet hardware, potentially disrupting network operations and requiring reboots until patched.

How an attack unfolds

An attacker issues an ethtool command specifying rule_cnt that results in rule_locs being NULL, then invokes mtk_hwlro_get_fdir_all which proceeds to use the unvalidated pointer without a prior check, triggering the dereference and system instability.

How to fix it

Apply the upstream fix by updating the Linux kernel to include commit 7776591e5ae2befff86579f68916a171971c6aab or later equivalent; rebuild and deploy the patched kernel image across all affected systems.

How to confirm the fix worked

Verify the presence of the fix commit in the running kernel source or binary; test ethtool RXNFC calls with rule_cnt=0 to confirm no crash occurs; monitor kernel logs for absence of mtk_hwlro_get_fdir_all related NULL dereference oops.

Typical attack path

1. Craft ethtool RXNFC request with rule_cnt set to trigger zero-size or failed allocation of rule_locs
2. Invoke mtk_hwlro_get_fdir_all via the MediaTek Ethernet driver path
3. Trigger NULL dereference leading to kernel panic or oops

How to detect it

Search kernel logs and dmesg for oops or panic messages referencing mtk_hwlro_get_fdir_all or NULL pointer dereference during ethtool RXNFC operations; review audit logs for unusual ethtool invocations from untrusted processes.

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all production Linux instances within the next maintenance window
• Restrict unprivileged ethtool access via capabilities or SELinux policies until patched
• Include the affected driver in automated kernel patch testing and deployment pipelines