CVE-2023-54156

Vulnerability

In the Linux kernel's sfc (Solarflare) network driver, a NULL pointer dereference can occur when efx_net_stats() is called while the NIC is being reset. During a reset (e.g., during an ethtool selftest), nic_data->mc_stats is freed and set to NULL. If statistics are requested at this time, the driver attempts to update hardware stats via efx_nic_update_stats(), leading to a crash [1][2].

Exploitation

The vulnerability is triggered when a local attacker or system process triggers a NIC reset (e.g., via ethtool selftest) and simultaneously reads network statistics (e.g., via ip link or /proc/net/dev). No special privileges are required beyond the ability to trigger a reset and read stats, which is typically available to unprivileged users on many systems. The race condition is a classic Time-of-Check Time-of-Use (TOCTOU) bug, where the stats pointer becomes NULL between validation and use [2].

Impact

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (denial of service). An attacker could repeatedly trigger this to cause persistent system unavailability. No code execution is expected, but the crash can disrupt operations. The vulnerability affects all Linux kernel versions with the sfc driver prior to the fix [1][2].

Mitigation

The fix, included in stable kernel updates, adds a check to skip stats update when mc_stats is NULL and ensures stats_lock is held during efx_ef10_fini_nic() to prevent the race [1][2]. Users should apply the latest kernel updates from their distribution. No workaround other than avoiding simultaneous reset and stats reads is available.