CVE-2024-40999

CVE-2024-40999

Critical · published July 12, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
49.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: ena: Add validation for completion descriptors consistency

Validate that `first` flag is set only for the first

descriptor in multi-buffer packets.

In case of an invalid descriptor, a reset will occur.

A new reset reason for RX data corruption has been added.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00627 · 49.5th percentile
Published
2024-07-12T17:15Z
Affected products (1)
ProductVersionsFixed in
linux/linux_kernel≥ 4.9, < 6.9.76.9.7
References (5)
https://git.kernel.org/stable/c/42146ee5286f16f1674a84f7c274dcca65c6ff2e · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/edb9a302cc9386142beffe5d9bbe4bfd36999eee · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/42146ee5286f16f1674a84f7c274dcca65c6ff2e · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 12 JUL 12:37Z
    net: ena: Add validation for completion descriptors consistency
    cvelistv5