CVE-2024-46834
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
27/09/2024
Last modified:
09/10/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
ethtool: fail closed if we can&#39;t get max channel used in indirection tables<br />
<br />
Commit 0d1b7d6c9274 ("bnxt: fix crashes when reducing ring count with<br />
active RSS contexts") proves that allowing indirection table to contain<br />
channels with out of bounds IDs may lead to crashes. Currently the<br />
max channel check in the core gets skipped if driver can&#39;t fetch<br />
the indirection table or when we can&#39;t allocate memory.<br />
<br />
Both of those conditions should be extremely rare but if they do<br />
happen we should try to be safe and fail the channel change.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.10.10 (excluding) |
To consult the complete list of CPE names with products and versions, see this page