oss-sec mailing list archives By Date By Thread CVE request -- Ethernet flow control vulnerability in SRIOV devices From: Igor Smolyar <igors () cs technion ac il> Date: Thu, 3 Dec 2015 17:39:58 +0200
    Hello,

    a design flaw found in current Ethernet SRIOV NIC deployments
    that enables untrusted malicious VMs to completely control
    the throughput and latency of other, unrelated VMs. The attack
    exploits Ethernet ”pause” frames, which enable network flow
    control functionality.

    Link to the paper published on USENIX Security 2015:
    https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-smolyar.pdf

    Intel published a security advisory INTEL-SA-00046 on that issue:
    https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00046&languageid=en-fr

    Could you please allocate a CVE id for this?
    Below are fixes from major SRIOV vendors.

    Intel published fixed drivers on kernel.org:
    ixgbe: add flow control ethertype to the anti-spoofing filter
    commit f079fa005aae08ee0e1bc32699874ff4f02e11c1

    i40e/i40evf: Add a workaround to drop all flow control frames
    commit e7358f54a3954df16d4f87e3cad35063f1c17de5

    Qlogic(ex Broadcom controllers) recently pushed the fix upstream.
    There is patch which pushed the new FW:
    http://lists.openwall.net/netdev/2015/11/19/73
    And another which changed the driver to employ it:
    https://patchwork.ozlabs.org/patch/547321/

    This is the header of the driver patch:
    Commit 46e8a249423ff "bnx2x: Add FW 7.13.1.0" added said .bin FW to
    linux-firmware; This patch incorporates the FW in the bnx2x driver.

     - Prevent VFs from sending MAC control frames; FW would treat a VF
    sending such a packet as malicious and block any further communication
    done by the VF.

    Mellanox also provided fix in firmware for ConnectX-3 devices.
    Fixed firmware version 2.35.5000

    Thanks,
    Igor Smolyar
By Date By Thread Current thread: CVE request -- Ethernet flow control vulnerability in SRIOV devices Igor Smolyar (Dec 03)
| [ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]