CVE-2024-35891

What it actually does

Missing null pointer check after ptp_parse_header() returns NULL in lan8814_get_sig_rx() and lan8814_get_sig_tx() due to abnormal or corrupted PTP packets, resulting in null pointer dereference.

Why it matters to the business

Potential kernel crash or denial of service on Linux systems using Micrel LAN8814 PHY devices with PTP, increasing operational downtime risk especially on servers or embedded devices.

How an attack unfolds

An attacker sends a malformed PTP packet over the network to trigger ptp_parse_header() returning NULL; the Micrel driver functions then dereference the NULL pointer without validation, causing a crash.

How to fix it

Upgrade the Linux kernel to a version containing commit 10608161696c2768f53426642f78a42bcaaa53e8 which adds the required ptp_header validation check.

How to confirm the fix worked

Inspect kernel source for the added ptp_header != NULL check in lan8814_get_sig_rx() and lan8814_get_sig_tx(); confirm updated kernel version post-upgrade.

Typical attack path

1. Deliver crafted or corrupted PTP packet to the target network interface
2. Force ptp_parse_header() to return NULL due to abnormal packet type
3. Execute null dereference in lan8814_get_sig_rx() or lan8814_get_sig_tx()
4. Trigger kernel panic or system instability

How to detect it

Search kernel logs, dmesg output, and crash dumps for oops or panic messages referencing micrel, lan8814, or ptp_parse_header functions.

• lan8814_get_sig_rx
• lan8814_get_sig_tx
• ptp_parse_header
• micrel phy null pointer

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all affected systems
• Apply network filtering to drop suspicious PTP traffic if immediate patching is not feasible
• Monitor kernel logs for related oops or panics during the remediation window