Vulnerability in Broadcom Bcm5780
CVE-2022-3643
Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.005 (39.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 39.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: +0.000
Affected products
- Broadcom Bcm5780
- Linux — versions consult Xen advisory XSA-423
- Linux Kernel
- Debian Linux — versions 10.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- xenbits.xenproject.org/xsa/advisory-423.txt (Vendor Advisory)
- www.openwall.com/lists/oss-security/2022/12/07/2 (mailing-list, Mailing List, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2022/12/msg00031.html (mailing-list, Mailing List, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2022/12/msg00034.html (mailing-list, Mailing List, Third Party Advisory)
- packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099…
Frequently asked questions
- What is CVE-2022-3643?
- CVE-2022-3643 is a medium-severity vulnerability in Broadcom Bcm5780, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 6.5/10. Published 2022-12-07.
- How severe is CVE-2022-3643?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2022-3643 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.