In the Linux kernel, the following vulnerability has been resolved:
net: enetc: check the number of BDs needed for xdp_frame
The size of xdp_redirect_arr array is ENETC_MAX_SKB_FRAGS. However, the
number of fragments contained in xdp_frame may be greater than or equal
to ENETC_MAX_SKB_FRAGS, which will cause the access to xdp_redirect_arr
to be out of bounds.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - Remote attackers can deliver multi-fragment frames to an XDP-enabled ingress path that bpf_redirect_map/devmap forwards to an ENETC PF netdev, reaching enetc_xdp_xmit via the standard XDP_REDIRECT flush path without local access.
AC:L - Once XDP redirect to ENETC is deployed, an attacker can reliably craft or segment traffic to produce xdp_frames with nr_frags+1>13; no race or uncontrollable memory layout is required to trigger the out-of-bounds write.
PR:N - Exploitation requires no attacker privileges when XDP redirect is pre-deployed on the gateway (normal for edge filtering); unprivileged users with CAP_NET_ADMIN via user namespaces can also attach the needed BPF/XDP programs.
UI:N - No victim interaction is required beyond sending crafted network traffic; exploitation is fully attacker-driven once the XDP redirect datapath exists.
S:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel/host security boundary, not a cross-VM or IOMMU scope change.
C:H - Stack out-of-bounds writes of enetc_tx_swbd structures past a 13-element array corrupt adjacent stack data and pointers, providing a memory-corruption primitive that can be leveraged for arbitrary kernel memory disclosure.
I:H - The overflow writes attacker-influenced enetc_tx_swbd fields (DMA addresses, lengths, frame pointers) beyond the buffer bounds, enabling heap/stack corruption suitable for arbitrary write and potential code execution.
A:H - Corrupting stack-resident transmit metadata and pointers in enetc_xdp_xmit can cause immediate kernel oops/panic or hung transmit paths, constituting total loss of availability.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - Remote attackers can deliver multi-fragment frames to an XDP-enabled ingress path that bpf_redirect_map/devmap forwards to an ENETC PF netdev, reaching enetc_xdp_xmit via the standard XDP_REDIRECT flush path without local access.
AC:L - Once XDP redirect to ENETC is deployed, an attacker can reliably craft or segment traffic to produce xdp_frames with nr_frags+1>13; no race or uncontrollable memory layout is required to trigger the out-of-bounds write.
PR:N - Exploitation requires no attacker privileges when XDP redirect is pre-deployed on the gateway (normal for edge filtering); unprivileged users with CAP_NET_ADMIN via user namespaces can also attach the needed BPF/XDP programs.
UI:N - No victim interaction is required beyond sending crafted network traffic; exploitation is fully attacker-driven once the XDP redirect datapath exists.
S:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel/host security boundary, not a cross-VM or IOMMU scope change.
C:H - Stack out-of-bounds writes of enetc_tx_swbd structures past a 13-element array corrupt adjacent stack data and pointers, providing a memory-corruption primitive that can be leveraged for arbitrary kernel memory disclosure.
I:H - The overflow writes attacker-influenced enetc_tx_swbd fields (DMA addresses, lengths, frame pointers) beyond the buffer bounds, enabling heap/stack corruption suitable for arbitrary write and potential code execution.
A:H - Corrupting stack-resident transmit metadata and pointers in enetc_xdp_xmit can cause immediate kernel oops/panic or hung transmit paths, constituting total loss of availability.
CVSS 3.1