Описание
In the Linux kernel, the following vulnerability has been resolved: ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() Fix using the untrusted value of proto->raw.pkt_len in function ice_vc_fdir_parse_raw() by verifying if it does not exceed the VIRTCHNL_MAX_SIZE_RAW_PACKET value.
Отчет
A low severity flaw was found in the Linux kernel's ice network driver in the flow director handling for virtual functions. When a virtual function (VF) on an Intel Ethernet Controller E810-based ice NIC sends a VIRTCHNL flow director request, the ice_vc_fdir_parse_raw() function in drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c uses the VF-supplied raw packet length (proto->raw.pkt_len) without first verifying that it does not exceed VIRTCHNL_MAX_SIZE_RAW_PACKET. A highly privileged local attacker, such as one who controls the guest virtual machine that owns the VF, could use this flaw to cause out-of-bounds memory access in the host kernel, resulting in a denial of service (kernel crash). Red Hat rates this flaw Low impact (CVSS 4.4, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) because exploitation requires high privileges and affects only the availability of the host; this differs from the higher CVE.org severity (8.7, Important), which assumes broader scope and confidentiality/integrity impact that the available technical evidence does not support. In Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt), this flaw is rated affected and the fix is currently deferred to a future update because of the low severity and the high privileges required for exploitation; the residual risk is limited to a local denial of service by an attacker who already controls a guest virtual machine with an ice VF on the host. Red Hat Enterprise Linux 6, 7, and 8, Red Hat In-Vehicle OS, and Red Hat's hosted OpenShift offerings (ARO and OSD) are not affected because the vulnerable code is not present in their kernels.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
4.4 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() Fix using the untrusted value of proto->raw.pkt_len in function ice_vc_fdir_parse_raw() by verifying if it does not exceed the VIRTCHNL_MAX_SIZE_RAW_PACKET value.
In the Linux kernel, the following vulnerability has been resolved: ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() Fix using the untrusted value of proto->raw.pkt_len in function ice_vc_fdir_parse_raw() by verifying if it does not exceed the VIRTCHNL_MAX_SIZE_RAW_PACKET value.
In the Linux kernel, the following vulnerability has been resolved: i ...
In the Linux kernel, the following vulnerability has been resolved: ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() Fix using the untrusted value of proto->raw.pkt_len in function ice_vc_fdir_parse_raw() by verifying if it does not exceed the VIRTCHNL_MAX_SIZE_RAW_PACKET value.
Уязвимость функции ice_vc_fdir_parse_raw() модуля drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c драйвера поддержки сетевых адаптеров Ethernet Intel ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
4.4 Medium
CVSS3