CVE-2023-54156

A flaw was identified in the sfc network driver within the Linux kernel where a NULL pointer dereference may occur when reading network statistics during a NIC reset. Specifically, the function efx_net_stats() (used as .ndo_get_stats64 for ethtool) can be invoked while the NIC’s internal data structures have already been torn down. In such a situation, nic_data->mc_stats may be NULL, leading to an unprotected dereference and a kernel crash (BUG) when accessing this pointer. The root cause is the lack of protection against accessing stale or freed data during concurrent operations involving NIC reset and statistics queries.

A Moderate severity flaw was found in the sfc network driver of the Linux kernel shipped in Red Hat Enterprise Linux 8 and 9. The efx_net_stats() callback (.ndo_get_stats64) can be invoked while the NIC is being reset, for example during an ethtool selftest; at that point the NIC has already been finalized and nic_data->mc_stats is NULL, so reading network statistics dereferences a NULL pointer and crashes the kernel. Triggering the crash requires reading statistics (for example via /proc/net/dev) concurrently with a NIC reset, a hard-to-time race condition whose impact is limited to availability, which is why Red Hat assesses this flaw as Moderate (CVSS 6.4) while the CVE.org record scores it 7.8 (Important). The kernel and kernel-rt packages in Red Hat Enterprise Linux 8 and 9 are affected, and fixes are currently deferred on those streams; the residual risk is a kernel crash (denial of service) on systems using sfc-based network cards when statistics are read during a NIC reset. Red Hat Enterprise Linux 6, 7, and 10, and Red Hat In-Vehicle OS 1.0, are not affected because the vulnerable code is not present in those releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the sfc kernel module from loading if it is not required for your network hardware. This can be achieved by creating a modprobe configuration file.

Create a file named /etc/modprobe.d/disable-sfc.conf with the following content:

install sfc /bin/true
blacklist sfc

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect:

dracut -f -v
reboot

This action may impact network connectivity if your system relies on the sfc driver for its network interface card.