Database/Firmware, BMC & network fabric
Linux ice driver: buffer overread reading transceiver EEPROM via ethtool
Impact
ice_get_module_eeprom() in the Intel E800-series driver reads the optics EEPROM in 8-byte blocks but its bounds check skips the final block, so the copy can run past the caller's buffer. Intel E810 NICs are common as the front-end Ethernet on GPU nodes alongside the InfiniBand or RoCE fabric, and newer ethtool versions issue exactly the short 1-byte read that exposes this. The reachable consequence is kernel memory disclosure or corruption from a privileged local ethtool call, not a remote path.
Who can reach it
Local only, and requires CAP_NET_ADMIN to issue the ethtool module-EEPROM request. No tenant in a GPU pod can reach it without host network admin capability.
What to do
Patch the host kernel to a stable release carrying the fix commits and reboot the node, or reload the ice module after draining workloads (reloading drops the node's Ethernet links). Affects hosts running the ice driver after commit e9c9692c8a81.
References
Related entries
- Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): A userspace DEVX consumer can issue a firmware command opcodeCVE-2023-53340 · Linux kernel (drivers/net/ethernet/mellanox/mlx5/core)High
- Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): When a regular receive queue is reactivated after an AF_XDPCVE-2023-53394 · Linux kernel (drivers/net/ethernet/mellanox/mlx5/core)High
- Linux kernel bnxt_re: device is deallocated before cleanup completes, giving a use-after-free on teardownCVE-2023-53504 · Linux kernel RDMA/bnxt_re (ib_dealloc_device ordering on driver teardown)High
- Linux kernel (drivers/infiniband/hw/bnxt_re): The driver keeps scheduling completion handlers for a queue pair afterCVE-2023-54048 · Linux kernel (drivers/infiniband/hw/bnxt_re)High
- Linux kernel mlx4_ib (legacy ConnectX-3 RDMA): Same class of bug on the older mlx4 stack: the user-suppliedCVE-2023-54168 · Linux kernel mlx4_ib (legacy ConnectX-3 RDMA)High
- Linux kernel RDMA/efa: wrong teardown order lets a failed QP/CQ destroy underflow a refcountCVE-2023-54201 · Linux kernel RDMA/efa driver (QP/CQ destroy path)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.