Bug 2275596 (CVE-2024-26830)
| Summary: | CVE-2024-26830 kernel: i40e: Do not allow untrusted VF to remove administratively set MAC | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Robb Gatica <rgatica> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | acaringi, allarkin, aquini, bhu, chwhite, cye, cyin, dbohanno, debarbos, dfreiber, drow, dvlasenk, esandeen, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kgrant, klaas, ldoskova, lgoncalv, lzampier, mleitner, mmilgram, mstowell, nmurray, ptalbert, rparrazo, rrobaina, rvrbovsk, scweaver, sidakwo, sukulkar, tglozar, vkumar, wcosta, williams, wmealing, ycote, ykopkova, zhijwang |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | kernel 6.1.79, kernel 6.6.18, kernel 6.7.6, kernel 6.8 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in Intel network adapters in the Linux kernel, where untrusted virtualized network interfaces can remove MAC addresses set by the system. This flaw allows an attacker with sufficient privileges to cause a denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2275597 | ||
| Bug Blocks: | 2275560 | ||
|
Description
Robb Gatica
2024-04-17 16:23:20 UTC
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 2275597] The result of automatic check (that is developed by Alexander Larkin) for this CVE-2024-26830 is: CHECK Maybe valid. Check manually. with impact MODERATE (that is approximation based on flags REMOTE VIRT NETWORK ; these flags parsed automatically based on patche data). Such automatic check happens only for Low/Moderates (and only when not from reporter, but parsing already existing CVE). Highs always checked manually (I check it myself and then we check it again in Remediation team). In rare cases some of the Moderates could be increased to High later. This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2024:8161 https://access.redhat.com/errata/RHSA-2024:8161 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:10941 https://access.redhat.com/errata/RHSA-2024:10941 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2025:0064 https://access.redhat.com/errata/RHSA-2025:0064 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2025:0063 https://access.redhat.com/errata/RHSA-2025:0063 Why is this fixed in various minor rhel versions -- 8.6 -- 8.8 -- 9.2 and not in the main rhel 8/9 versions? They are marked as "affected" in https://access.redhat.com/security/cve/CVE-2024-26830 (In reply to Klaas Demter from comment #19) > Why is this fixed in various minor rhel versions -- 8.6 -- 8.8 -- 9.2 and > not in the main rhel 8/9 versions? They are marked as "affected" in > https://access.redhat.com/security/cve/CVE-2024-26830 Hi Klaas, This issue was fixed for the lead RHEL 8 and 9 versions in errata that incorporated many other fixes: RHSA-2024:2394 (RHEL 9.4) RHSA-2024:3138 (RHEL 8.10) I'm working on an issue with the metadata for this flaw, but the erroneous "Affected" entries for RHEL 8 and 9 should be resolved in a day or two. |