Bug 2153060 (CVE-2022-3107)

Summary: CVE-2022-3107 kernel: hv_netvsc: NULL pointer dereference in netvsc_get_ethtool_stats()
Product: [Other] Security Response Reporter: Sage McTaggart <amctagga>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: acaringi, allarkin, bhu, chwhite, crwood, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, ldoskova, lgoncalv, lleshchi, lzampier, mcascell, nmurray, ptalbert, qzhao, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: kernel 5.17 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2061574, 2067251, 2086611, 2086626, 2214243, 2214244, 2214245, 2214246    
Bug Blocks: 2153051    

Description Sage McTaggart 2022-12-13 22:02:05 UTC
[Suggested description]
An issue was discovered in the Linux kernel through 5.16-rc6.
netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check
of the return value of kvmalloc_array() and will cause the null pointer


[VulnerabilityType Other]
NULL Pointer Dereference


[Vendor of Product]
the development group


[Affected Product Code Base]
Linux kernel - 5.16-rc6




Jiasheng Jiang

Comment 4 Mauro Matteo Cascella 2023-06-12 08:58:27 UTC
Upstream commit:

Comment 6 Mauro Matteo Cascella 2023-06-12 09:13:09 UTC
This issue was fixed upstream in version 5.17. The kernel packages as shipped in the following Red Hat products were previously updated to a version that contains the fix via the following errata:

kernel in Red Hat Enterprise Linux 8

kernel-rt in Red Hat Enterprise Linux 8

kernel in Red Hat Enterprise Linux 9

kernel-rt in Red Hat Enterprise Linux 9