Intel Ethernet Controller E810 firmware: Out-of-bounds write inside E810 firmware, reachable from a privileged Ring-0

Impact

Out-of-bounds write inside E810 firmware, reachable from a privileged Ring-0 software adversary on the host, causing denial of service. The important framing for an operator is that this is a **write** primitive into NIC firmware from the host: on a bare-metal rental where the tenant has kernel privilege, the boundary between 'a tenant had root on the node' and 'the NIC's firmware state was modified' is exactly what this class of bug erodes. The published impact is DoS, but the primitive is the concern.

Who can reach it

Privileged local software on the host (Ring 0 / bare-metal OS). Any tenant with root on a rented bare-metal node qualifies.

What to do

Flash E810 firmware to cvl fw 1.7.8.x or later; cold power cycle. Beyond the patch: if you rent bare metal, reflash NIC firmware from a known-good image at tenant handoff and verify the version afterwards, because a patched-but-unverified NIC is not a clean NIC.

References