CVE-2023-54070
Description
A flaw was found in the Linux kernel's igb driver. When the igb module is loaded with Single Root I/O Virtualization (SR-IOV) enabled on certain network adapters, and the SR-IOV initialization subsequently fails, the driver does not properly clean up allocated resources. A local user can exploit this improper cleanup by attempting to remove the igb module, which may cause the system to hang or crash, leading to a Denial of Service (DoS).
Mitigation
To mitigate this issue, prevent the `igb` kernel module from loading with SR-IOV enabled. If the `igb` driver is not in use, blacklist the module by creating a file `/etc/modprobe.d/blacklist-igb.conf` with the content `blacklist igb`. Regenerate the initramfs and reboot the system for the changes to take effect. If the `igb` driver is required but SR-IOV functionality is not, ensure the `max_vfs` parameter is set to `0` by creating `/etc/modprobe.d/igb.conf` with `options igb max_vfs=0`. A system reboot is required for these changes to apply.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Confidentiality,Availability,Integrity
Technical Impact: Read Application Data; DoS: Crash, Exit, or Restart; Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
