Vulnerability in Broadcom Bcm5780
CVE-2022-3643
Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior.
EPSS: 0.005 (37.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H.
Affected products
- Broadcom Bcm5780
- Linux — versions consult Xen advisory XSA-423
- Linux Linux_kernel
- Debian Debian_linux — versions 10.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@xen.org (Vendor Advisory)
- security@xen.org (mailing-list, Mailing List, Third Party Advisory)
- security@xen.org (mailing-list, Mailing List, Third Party Advisory)
- security@xen.org (mailing-list, Mailing List, Third Party Advisory)
- security@xen.org
Frequently asked questions
- What is CVE-2022-3643?
- CVE-2022-3643 is a medium-severity vulnerability in Broadcom Bcm5780, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 6.5/10. Published 2022-12-07.
- How severe is CVE-2022-3643?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2022-3643 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.