qeth QueryIoctl Overflow

Vulnerability analysis

The qeth network driver's SNMP and ARP query ioctl handlers accept a user-supplied buffer length, allocate a buffer of that size, and later pass the length along with a fixed non-zero offset to a callback. The callback validates the copy size by subtracting the offset from the length using unsigned 32-bit arithmetic; when the user-supplied length is smaller than the offset, the subtraction wraps to a very large value, the bounds check passes, and a subsequent memory copy writes far past the end of the allocated buffer. A zero-length request also produces a special small-allocation pointer that bypasses the existing NULL check. The fix rejects any buffer length smaller than the fixed offset before allocating, so the unsigned subtraction in the callback can no longer underflow. The vulnerable path is reachable locally by any process holding CAP_NET_ADMIN in the init namespace on an s390 system with a qeth network device configured.