i40e: Fix NULL ptr dereference on VSI filter sync
Summary
GSD-2021-1002237: i40e: Fix NULL ptr dereference on VSI filter sync. Affects Kernel versions >= 41c445ff0f482bb6e6b72dcee9e598e20575f743, < 78f2a9e831f9610e3655a0be5e675e1aa2472089. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The i40e package is a driver for Intel Ethernet Controller XL710 family devices. It is responsible for managing the network interface and providing communication capabilities for these devices. The vulnerability in question involves a NULL pointer dereference during the synchronization of VSI (Virtual Station Interface) filters. This vulnerability can potentially lead to a system crash or other unexpected behavior.
Vulnerability Detail
The vulnerability arises from a NULL pointer dereference when synchronizing VSI filters in the i40e package. This occurs when a NULL pointer is accessed, causing the program to crash or exhibit undefined behavior. The impact of this vulnerability can range from a denial of service (system crash) to potential security implications if an attacker can trigger the vulnerable code path. The vulnerability was introduced in version v3.12 of the Linux Kernel and has been fixed in version v4.14.256.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The i40e package in the Linux Kernel is vulnerable to a NULL pointer dereference issue during VSI filter synchronization. This vulnerability can lead to system crashes and potential security risks. It is recommended to update the Linux Kernel to version v4.14.256 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The i40e package is a driver for Intel Ethernet Controller XL710 family devices. It provides network interface management and communication capabilities for these devices.
A NULL pointer dereference occurs when a program attempts to access memory using a pointer that is not pointing to a valid memory location (i.e., it is NULL). This can lead to a program crash or undefined behavior.
VSI filter synchronization refers to the process of ensuring that the filters applied to Virtual Station Interfaces (VSIs) are consistent across different components or nodes in a network. It helps maintain the desired network traffic filtering rules.
The potential consequences of this vulnerability include system crashes (denial of service) and potential security implications if an attacker can exploit the vulnerable code path.
To update the Linux Kernel, you can obtain the latest version from the official Linux Kernel repository or use your Linux distribution's package manager to install the updated kernel package.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
