CVE-2024-26830 i40e: Do not allow untrusted VF to remove administratively set MAC
An untrusted virtual function can bypass administrative MAC address restrictions by removing the assigned MAC when the interface is brought down.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26830?
CVE-2024-26830 is a high-severity vulnerability in Linux kernel, published on 17 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
i40e: Do not allow untrusted VF to remove administratively set MAC
Currently when PF administratively sets VF's MAC address and the VF is put down (VF tries to delete all MACs) then the MAC is removed from MAC filters and primary VF MAC is zeroed.
Do not allow untrusted VF to remove primary MAC when it was set administratively by PF.
Reproducer: 1) Create VF 2) Set VF interface up 3) Administratively set the VF's MAC 4) Put VF interface down
[root@host ~]# echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs [root@host ~]# ip link set enp2s0f0v0 up [root@host ~]# ip link set enp2s0f0 vf 0 mac fe:6c:b5:da:c7:7d [root@host ~]# ip link show enp2s0f0 23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff vf 0 link/ether fe:6c:b5:da:c7:7d brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off [root@host ~]# ip link set enp2s0f0v0 down [root@host ~]# ip link show enp2s0f0 23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff vf 0 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
Which versions are affected by CVE-2024-26830?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-26830?
Apply the vendor's patch.
Is CVE-2024-26830 being exploited?
There is no known exploitation of CVE-2024-26830 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-59445, BELL-CVE-2024-26830, DEBIAN-CVE-2024-26830, GHSA-wvxq-2p8c-hj2m, ROOT-OS-DEBIAN-11-CVE-2024-26830, UBUNTU-CVE-2024-26830.