Описание
In the Linux kernel, the following vulnerability has been resolved:
i40e: add max boundary check for VF filters
There is no check for max filters that VF can request. Add it.
A flaw was found in the Linux kernel's i40e network driver. A local attacker with low privileges can exploit a missing maximum boundary check for Virtual Function (VF) filters. By requesting an unbounded number of filters, the attacker can cause resource exhaustion, leading to a denial of service (DoS). This issue may also impact the confidentiality and integrity of data due to the system's compromised state.
Отчет
A flaw of moderate severity was found in the Linux kernel's i40e network driver shipped in Red Hat Enterprise Linux. The driver lacked a maximum boundary check on the number of filters a Virtual Function (VF) may request. A local attacker with low privileges who can issue VF filter requests could request an unbounded number of filters and exhaust driver resources, resulting in a denial of service. Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt) are affected; the fix is currently deferred for these streams, so the residual risk of local resource exhaustion and denial of service remains until a fix is delivered. Red Hat Enterprise Linux 6 Extended Lifecycle Support and Red Hat In-Vehicle OS 1 are marked not affected because the vulnerable code is not present in those products. Red Hat assessed this flaw as Moderate (CVSS 5.3) rather than the upstream CVE.org High rating (7.3) because exploitation requires local access with VF privileges and the primary consequence is availability impact through resource exhaustion.
Меры по смягчению последствий
Prevent the i40e kernel module from loading to mitigate this vulnerability. Create a file /etc/modprobe.d/i40e-blacklist.conf with the following content:
Then, regenerate the initramfs and reboot the system for the changes to take effect. This action will disable the i40e network driver, potentially impacting network functionality if i40e-based network adapters are in use. A system reboot is required for the changes to be fully applied.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: i40e: add max boundary check for VF filters There is no check for max filters that VF can request. Add it.
In the Linux kernel, the following vulnerability has been resolved: i40e: add max boundary check for VF filters There is no check for max filters that VF can request. Add it.
In the Linux kernel, the following vulnerability has been resolved: i ...
In the Linux kernel, the following vulnerability has been resolved: i40e: add max boundary check for VF filters There is no check for max filters that VF can request. Add it.
EPSS
5.3 Medium
CVSS3