In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rslt->ptype, prof->ptypes) operates on a DECLARE_BITMAP of ICE_…
High CVSS 8.8
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rslt->ptype, prof->ptypes) operates on a DECLARE_BITMAP of ICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF from providing ptype >= 1024 through VIRTCHNL, resulting in a write past the end of the bitmap and a kernel page fault. Reproduced with a custom kernel module injecting a crafted VIRTCHNL_OP_ADD_RSS_CFG on E810-C QSFP (8086:1592), FW 4.91 …
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/33cc15aaf2491166dddc018b24b3b7db53ec01b2
- https://git.kernel.org/stable/c/59abb87159c53605c063f6e2ceb215b5eba43ee6
- https://git.kernel.org/stable/c/5e496f2b615cec4b45537cfb5b54f36a51dc8753
- https://git.kernel.org/stable/c/fe2f8d5a77adea38e889fe3d6cde1b76d4a635bf
Timeline
- nvd_ingest NVD