Intel Ethernet Controller E810 Series firmware: A race condition in E810 firmware lets an authenticated local user

Impact

A race condition in E810 firmware lets an authenticated local user cause denial of service. In a bare-metal multi-tenant cluster 'authenticated local' is the tenant, so this is a tenant able to kill its own node's NIC — and on shared-NIC designs, potentially the NIC serving other functions on the same host.

Who can reach it

Authenticated local access to the host. In a bare-metal GPU rental model, that is the customer.

What to do

Flash E810 firmware to 1.7.2.4 or later; cold power cycle. This one is a good argument for reflashing NIC firmware as part of tenant handoff rather than only on a CVE-driven schedule.

References

Related entries

• Intel E810 Ethernet Controller firmware: Out-of-bounds read in E810 firmware reachable from an adjacentCVE-2023-28376 · Intel E810 Ethernet Controller firmwareMedium
• Intel processors (register file data sampling): RFDS: stale data left in the integer, floating-point and vectorCVE-2023-28746 · Intel processors (register file data sampling)Medium
• AMI MegaRAC SPx (SPX REST API): Path traversal in the BMC REST API letting a low-privilege user read arbitrary filesCVE-2023-34345 · AMI MegaRAC SPx (SPX REST API)Medium
• Supermicro BMC (IPMI web interface, XSS): Another injection point in the BMC web interface, lower-impact thanCVE-2023-40285 · Supermicro BMC (IPMI web interface, XSS)Medium
• EDK II NetworkPkg (DHCPv6 Advertise, IA_NA/IA_TA option parsing): An integer underflow when parsingCVE-2023-45229 · EDK II NetworkPkg (DHCPv6 Advertise, IA_NA/IA_TA option parsing)Medium
• EDK II NetworkPkg (IPv6 Neighbor Discovery Redirect handling): A truncated ND Redirect message drives an out-of-boundsCVE-2023-45231 · EDK II NetworkPkg (IPv6 Neighbor Discovery Redirect handling)Medium