Intel Ethernet E810 Series and Ethernet 700 Series firmware: Out-of-bounds write in firmware across both the E810 line

Impact

Out-of-bounds write in firmware across both the E810 line and the older 700 Series (X710/XL710/XXV710), triggerable by a privileged host user. Notable because it spans two adapter generations — if you have a mixed fleet, the version target differs per family (E810 before 1.7.0.8, 700 Series before 9.101) and a single blanket firmware policy will miss half of it.

Who can reach it

Privileged local user on the host.

What to do

Flash E810 to 1.7.0.8+ and 700-Series adapters to 9.101+. Cold power cycle on both. Because the two families need different images, build the NVM update into your provisioning pipeline keyed on device ID rather than doing it by hand.

References

Related entries

• Intel processors with SGX (shared resource isolation): Improper isolation of shared microarchitectural resources lets aCVE-2022-38090 · Intel processors with SGX (shared resource isolation)Medium
• Linux kernel RDMA core netlink (nldev_stat_set_counter_dynamic_doit): The dynamic-counter netlink setter bounded itsCVE-2022-49199 · Linux kernel RDMA core netlink (nldev_stat_set_counter_dynamic_doit)Medium
• AMD SEV-SNP firmware, guest teardown / UMC key seed handling: TENANT HANDOFF FAILURECVE-2023-31355 · AMD SEV-SNP firmware, guest teardown / UMC key seed handlingMedium
• AMI MegaRAC SPx (IPMI handler): Arbitrary file upload and download through the BMC's IPMI handlerCVE-2023-34342 · AMI MegaRAC SPx (IPMI handler)Medium
• Intel TDX module: The TDX module is the software that stands between the host/VMM and every confidential VM on the boxCVE-2023-47855 · Intel TDX moduleMedium
• Cisco NX-OS CLI: Command injection giving root on the switch's underlying OS from an admin CLI sessionCVE-2024-20399 · Cisco NX-OS CLIMedium