Vulnerability in ixgbe package: Panic when setting sriov_numvfs to zero
Summary
GSD-2022-1004525: ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero. Affects Kernel versions >= d773d1310625be3b040b436178ad59a0af8888f1, < b82de63f8f817b5735480293dda8e92ba8170c52. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ixgbe package is a driver for Intel 10 Gigabit Ethernet (10GbE) network adapters. It provides support for various features and configurations of these adapters. One of the functionalities it offers is the ability to set the number of virtual functions (VFs) using the 'sriov_numvfs' parameter. However, a vulnerability has been discovered in the package that can lead to a panic when setting 'sriov_numvfs' to zero.
Vulnerability Detail
The vulnerability in the ixgbe package arises from a lack of locking mechanism when setting 'sriov_numvfs' to zero. This can result in a panic, causing the system to crash. The vulnerability was introduced in version v3.6 of the Linux Kernel and affects all subsequent versions until v5.10.134. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid setting 'sriov_numvfs' to zero. Instead, a non-zero value can be used to configure the desired number of virtual functions. This will prevent triggering the vulnerability and the subsequent panic.
Conclusion
In conclusion, the ixgbe package is vulnerable to a panic condition when setting 'sriov_numvfs' to zero. To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.10.134 or later. Alternatively, users can employ the workaround of using a non-zero value for 'sriov_numvfs'. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The ixgbe package is a driver for Intel 10 Gigabit Ethernet (10GbE) network adapters. It provides support for various features and configurations of these adapters.
The vulnerability can lead to a panic condition in the system, causing it to crash. However, the actual impact and attack plausibility have not been proven yet.
The vulnerability affects versions of the Linux Kernel from v3.6 to v5.10.133. It is fixed in version v5.10.134.
To fix this vulnerability, update the Linux Kernel to version v5.10.134 or later. This fix was implemented in commit b82de63f8f817b5735480293dda8e92ba8170c52.
Yes, a workaround is to avoid setting 'sriov_numvfs' to zero. Instead, use a non-zero value to configure the desired number of virtual functions.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
