Mitigation Strategies

The vulnerability is fixed by clearing the ICE_TX_RING_FLAGS_TXTIME bit in the Linux kernel's ice driver to avoid a potential NULL pointer dereference during error handling in ice_set_ringparam().

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix for the ice driver.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Linux kernel's ice driver, specifically in the function ice_set_ringparam(). The issue occurs because the function nullifies the tstamp_ring of temporary tx_rings without clearing the ICE_TX_RING_FLAGS_TXTIME bit. If this bit remains set and the subsequent call to ice_setup_tx_ring() fails, a NULL pointer dereference can happen during the error handling sequence. This leads to a crash when the code attempts to access a NULL pointer in the timestamp ring descriptors.

The problem arises in the unwinding sequence involving ice_clean_tx_ring(), ice_is_txtime_cfg(), ice_free_tx_tstamp_ring(), and ice_free_tstamp_ring(), where the NULL dereference occurs. The fix involves clearing the ICE_TX_RING_FLAGS_TXTIME bit to prevent this NULL pointer dereference.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a NULL pointer dereference in the Linux kernel's ice driver, which may lead to a kernel crash or system instability. Such crashes can result in denial of service conditions where the affected system or device becomes unresponsive or requires a reboot.

Useful 0 Not Useful 0