oss-security - CVE request -- Ethernet flow control vulnerability in SRIOV devices

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <5660624E.50205@cs.technion.ac.il>
Date: Thu, 3 Dec 2015 17:39:58 +0200
From: Igor Smolyar <igors@...technion.ac.il>
To: oss-security@...ts.openwall.com
Subject: CVE request -- Ethernet flow control vulnerability in SRIOV devices

Hello,

a design flaw found in current Ethernet SRIOV NIC deployments 
that enables untrusted malicious VMs to completely control 
the throughput and latency of other, unrelated VMs. The attack 
exploits Ethernet ”pause” frames, which enable network flow 
control functionality. 

Link to the paper published on USENIX Security 2015:
https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-smolyar.pdf

Intel published a security advisory INTEL-SA-00046 on that issue:
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00046&languageid=en-fr

Could you please allocate a CVE id for this?
Below are fixes from major SRIOV vendors. 

Intel published fixed drivers on kernel.org:
ixgbe: add flow control ethertype to the anti-spoofing filter
commit f079fa005aae08ee0e1bc32699874ff4f02e11c1

i40e/i40evf: Add a workaround to drop all flow control frames
commit e7358f54a3954df16d4f87e3cad35063f1c17de5

Qlogic(ex Broadcom controllers) recently pushed the fix upstream.
There is patch which pushed the new FW:
http://lists.openwall.net/netdev/2015/11/19/73
And another which changed the driver to employ it:
https://patchwork.ozlabs.org/patch/547321/

This is the header of the driver patch:
Commit 46e8a249423ff "bnx2x: Add FW 7.13.1.0" added said .bin FW to
linux-firmware; This patch incorporates the FW in the bnx2x driver.

 - Prevent VFs from sending MAC control frames; FW would treat a VF
sending such a packet as malicious and block any further communication
done by the VF.

Mellanox also provided fix in firmware for ConnectX-3 devices.
Fixed firmware version 2.35.5000

Thanks,
Igor Smolyar

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.