Описание
In the Linux kernel, the following vulnerability has been resolved:
qede: fix out-of-bounds check for cqe->len_list[]
Move index check before element access.
A flaw was found in the qede driver of the Linux kernel. An out-of-bounds read vulnerability exists due to an incorrect index check for cqe->len_list[] before element access. This flaw could potentially allow an attacker to cause a denial of service or disclose sensitive information.
Отчет
An out of bounds read in the qede TPA receive path can occur because cqe len_list is read before the loop checks that the index is within ARRAY_SIZE. A remote sender may be able to influence the RX aggregation path by sending traffic that reaches a host using the qede driver with TPA enabled, although reliable triggering depends on NIC firmware behavior and CQE generation. For the CVSS the PR:N is used because no local account on the victim is required if the vulnerable network interface is reachable by the attacker. The issue is network reachable through received Ethernet traffic rather than through a local device interface. Impact is at least denial of service via kernel crash. In the paranoid interpretation, limited confidentiality or integrity impact is kept possible because an out of bounds value is consumed by later skb fragment handling, but the patch does not show an arbitrary write primitive.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe->len_list[] Move index check before element access.
In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe->len_list[] Move index check before element access.
In the Linux kernel, the following vulnerability has been resolved: q ...
EPSS
7.5 High
CVSS3