Date: Thu, 3 Dec 2015 17:39:58 +0200 From: Igor Smolyar <igors@...technion.ac.il> To: oss-security@...ts.openwall.com Subject: CVE request -- Ethernet flow control vulnerability in SRIOV devices Hello, a design flaw found in current Ethernet SRIOV NIC deployments that enables untrusted malicious VMs to completely control the throughput and latency of other, unrelated VMs. The attack exploits Ethernet ”pause” frames, which enable network flow control functionality. Link to the paper published on USENIX Security 2015: https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-smolyar.pdf Intel published a security advisory INTEL-SA-00046 on that issue: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00046&languageid=en-fr Could you please allocate a CVE id for this? Below are fixes from major SRIOV vendors. Intel published fixed drivers on kernel.org: ixgbe: add flow control ethertype to the anti-spoofing filter commit f079fa005aae08ee0e1bc32699874ff4f02e11c1 i40e/i40evf: Add a workaround to drop all flow control frames commit e7358f54a3954df16d4f87e3cad35063f1c17de5 Qlogic(ex Broadcom controllers) recently pushed the fix upstream. There is patch which pushed the new FW: http://lists.openwall.net/netdev/2015/11/19/73 And another which changed the driver to employ it: https://patchwork.ozlabs.org/patch/547321/ This is the header of the driver patch: Commit 46e8a249423ff "bnx2x: Add FW 184.108.40.206" added said .bin FW to linux-firmware; This patch incorporates the FW in the bnx2x driver. - Prevent VFs from sending MAC control frames; FW would treat a VF sending such a packet as malicious and block any further communication done by the VF. Mellanox also provided fix in firmware for ConnectX-3 devices. Fixed firmware version 2.35.5000 Thanks, Igor Smolyar
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ