oss-sec
mailing list archives
CVE request -- Ethernet flow control vulnerability in SRIOV devices
From: Igor Smolyar <igors () cs technion ac il>
Date: Thu, 3 Dec 2015 17:39:58 +0200
Hello,
a design flaw found in current Ethernet SRIOV NIC deployments
that enables untrusted malicious VMs to completely control
the throughput and latency of other, unrelated VMs. The attack
exploits Ethernet ”pause” frames, which enable network flow
control functionality.
Link to the paper published on USENIX Security 2015:
https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-smolyar.pdf
Intel published a security advisory INTEL-SA-00046 on that issue:
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00046&languageid=en-fr
Could you please allocate a CVE id for this?
Below are fixes from major SRIOV vendors.
Intel published fixed drivers on kernel.org:
ixgbe: add flow control ethertype to the anti-spoofing filter
commit f079fa005aae08ee0e1bc32699874ff4f02e11c1
i40e/i40evf: Add a workaround to drop all flow control frames
commit e7358f54a3954df16d4f87e3cad35063f1c17de5
Qlogic(ex Broadcom controllers) recently pushed the fix upstream.
There is patch which pushed the new FW:
http://lists.openwall.net/netdev/2015/11/19/73
And another which changed the driver to employ it:
https://patchwork.ozlabs.org/patch/547321/
This is the header of the driver patch:
Commit 46e8a249423ff "bnx2x: Add FW 7.13.1.0" added said .bin FW to
linux-firmware; This patch incorporates the FW in the bnx2x driver.
- Prevent VFs from sending MAC control frames; FW would treat a VF
sending such a packet as malicious and block any further communication
done by the VF.
Mellanox also provided fix in firmware for ConnectX-3 devices.
Fixed firmware version 2.35.5000
Thanks,
Igor Smolyar
By Date
By Thread
Current thread:
- CVE request -- Ethernet flow control vulnerability in SRIOV devices Igor Smolyar (Dec 03)
|