Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 3 Dec 2015 17:39:58 +0200
From: Igor Smolyar <igors@...technion.ac.il>
To: oss-security@...ts.openwall.com
Subject: CVE request -- Ethernet flow control vulnerability in SRIOV devices

Hello,

a design flaw found in current Ethernet SRIOV NIC deployments 
that enables untrusted malicious VMs to completely control 
the throughput and latency of other, unrelated VMs. The attack 
exploits Ethernet ”pause” frames, which enable network flow 
control functionality. 

Link to the paper published on USENIX Security 2015:
https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-smolyar.pdf

Intel published a security advisory INTEL-SA-00046 on that issue:
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00046&languageid=en-fr

Could you please allocate a CVE id for this?
Below are fixes from major SRIOV vendors. 


Intel published fixed drivers on kernel.org:
ixgbe: add flow control ethertype to the anti-spoofing filter
commit f079fa005aae08ee0e1bc32699874ff4f02e11c1

i40e/i40evf: Add a workaround to drop all flow control frames
commit e7358f54a3954df16d4f87e3cad35063f1c17de5



Qlogic(ex Broadcom controllers) recently pushed the fix upstream.
There is patch which pushed the new FW:
http://lists.openwall.net/netdev/2015/11/19/73
And another which changed the driver to employ it:
https://patchwork.ozlabs.org/patch/547321/

This is the header of the driver patch:
Commit 46e8a249423ff "bnx2x: Add FW 7.13.1.0" added said .bin FW to
linux-firmware; This patch incorporates the FW in the bnx2x driver.

 - Prevent VFs from sending MAC control frames; FW would treat a VF
sending such a packet as malicious and block any further communication
done by the VF.



Mellanox also provided fix in firmware for ConnectX-3 devices.
Fixed firmware version 2.35.5000


Thanks,
Igor Smolyar

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ