Intel E810 Ethernet Controller firmware: Out-of-bounds read in E810 firmware reachable from an adjacent

Impact

Out-of-bounds read in E810 firmware reachable from an adjacent, unauthenticated attacker, causing denial of service. Adjacent means the same L2 segment — in a leaf/spine cluster that is every other node in the rack, including other tenants' nodes if you share a VLAN. One compromised tenant machine can walk the rack knocking NICs offline.

Who can reach it

Unauthenticated, adjacent — a host on the same layer-2 segment as the target NIC.

What to do

Flash E810 firmware to 1.7.1 or later. Cold power cycle required for the NVM image to activate; plan a per-node drain. If you cannot patch immediately, keeping tenants on separate VLANs limits who is 'adjacent' — a switch config change that meaningfully shrinks the exposed set.

References

Related entries

• Intel E810 Ethernet Controller firmware: Buffer overflow in early E810 firmware, triggerable by an unauthenticatedCVE-2020-24501 · Intel E810 Ethernet Controller firmwareMedium
• Intel processors (register file data sampling): RFDS: stale data left in the integer, floating-point and vectorCVE-2023-28746 · Intel processors (register file data sampling)Medium
• AMI MegaRAC SPx (SPX REST API): Path traversal in the BMC REST API letting a low-privilege user read arbitrary filesCVE-2023-34345 · AMI MegaRAC SPx (SPX REST API)Medium
• Supermicro BMC (IPMI web interface, XSS): Another injection point in the BMC web interface, lower-impact thanCVE-2023-40285 · Supermicro BMC (IPMI web interface, XSS)Medium
• EDK II NetworkPkg (DHCPv6 Advertise, IA_NA/IA_TA option parsing): An integer underflow when parsingCVE-2023-45229 · EDK II NetworkPkg (DHCPv6 Advertise, IA_NA/IA_TA option parsing)Medium
• EDK II NetworkPkg (IPv6 Neighbor Discovery Redirect handling): A truncated ND Redirect message drives an out-of-boundsCVE-2023-45231 · EDK II NetworkPkg (IPv6 Neighbor Discovery Redirect handling)Medium