Описание
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: restore the hardware filters on open bcmgenet_hfb_init() runs INIT_LIST_HEAD() on priv->rxnfc_list, which drops every rule off the list, and bcmgenet_open() calls it on each ifup. Every rule the user configured is silently lost:
ethtool -N eth0 flow-type ether dst $MAC action 0
Added rule with ID 0
ethtool -n eth0 | grep -c Filter:
1
ip link set eth0 down && ip link set eth0 up
ethtool -n eth0 | grep -c Filter:
0
Initialise the lists once at probe and restore the rules on open, as
bcmgenet_resume() already does.
A flaw was found in the Linux kernel's Broadcom GENET network driver (bcmgenet). When a network interface is brought up or restarted, the driver reinitializes its rule tracking, causing user-configured hardware packet filtering rules to be silently discarded. Consequently, incoming network traffic may bypass intended traffic filtering or routing controls without administrator awareness.
Отчет
Red Hat has rated the impact of this flaw as low. A flaw was found in the Linux kernel's Broadcom GENET Ethernet driver (bcmgenet). Every time a GENET-based network interface is brought up, bcmgenet_open() calls bcmgenet_hfb_init(), which re-initializes the driver's receive flow classification (rxnfc) rule list, silently discarding all hardware packet filtering rules the administrator configured with ethtool. After an interface restart (link down and up), incoming traffic can therefore bypass the intended hardware receive filtering or queue-steering rules without any notification. The flaw is not directly network reachable (received packets do not trigger it) and requires both configured rxnfc rules and an interface restart to manifest; it does not provide code execution, memory corruption, or privilege escalation, and its consequence is limited to the integrity of local packet filtering policy. Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases based on RHEL CoreOS 9 are affected. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in their kernels. Because this is a low-impact functional issue rather than an urgent security defect, the fix is deferred for the affected streams and will be delivered in a future planned update rather than an immediate z-stream fix; until then, the residual risk is that configured hardware receive filters are silently lost after any interface restart, allowing traffic to bypass the intended filtering until the rules are re-applied.
Меры по смягчению последствий
A workaround is available: the discarded rules can be re-applied after each interface restart. Administrators who rely on ethtool rxnfc hardware filtering rules on a GENET-based interface can re-add them with ethtool -N (and verify with ethtool -n) after the interface is brought up, for example via a NetworkManager dispatcher script or a systemd unit triggered when the interface becomes active. Note that a short window remains between interface activation and rule re-application during which the hardware filters are absent. The permanent fix, which restores the configured rules automatically on interface open, is deferred to a future update of the affected Red Hat products.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: restore the hardware filters on open bcmgenet_hfb_init() runs INIT_LIST_HEAD() on priv->rxnfc_list, which drops every rule off the list, and bcmgenet_open() calls it on each ifup. Every rule the user configured is silently lost: # ethtool -N eth0 flow-type ether dst $MAC action 0 Added rule with ID 0 # ethtool -n eth0 | grep -c Filter: 1 # ip link set eth0 down && ip link set eth0 up # ethtool -n eth0 | grep -c Filter: 0 Initialise the lists once at probe and restore the rules on open, as bcmgenet_resume() already does.
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: restore the hardware filters on open bcmgenet_hfb_init() runs INIT_LIST_HEAD() on priv->rxnfc_list, which drops every rule off the list, and bcmgenet_open() calls it on each ifup. Every rule the user configured is silently lost: # ethtool -N eth0 flow-type ether dst $MAC action 0 Added rule with ID 0 # ethtool -n eth0 | grep -c Filter: 1 # ip link set eth0 down && ip link set eth0 up # ethtool -n eth0 | grep -c Filter: 0 Initialise the lists once at probe and restore the rules on open, as bcmgenet_resume() already does.
In the Linux kernel, the following vulnerability has been resolved: n ...
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: restore the hardware filters on open bcmgenet_hfb_init() runs INIT_LIST_HEAD() on priv->rxnfc_list, which drops every rule off the list, and bcmgenet_open() calls it on each ifup. Every rule the user configured is silently lost: # ethtool -N eth0 flow-type ether dst $MAC action 0 Added rule with ID 0 # ethtool -n eth0 | grep -c Filter: 1 # ip link set eth0 down && ip link set eth0 up # ethtool -n eth0 | grep -c Filter: 0 Initialise the lists once at probe and restore the rules on open, as bcmgenet_resume() already does.
EPSS
5.5 Medium
CVSS3