CVE-2010-4263: Null Pointer Dereference
If igb's SR-IOV and promiscuous mode are enabled and the interface receives a tag VLAN packet, this will result in a null pointer dereference. To fix this, we will backport upstream commit 31b24b95 to ensure that vlangroreceive is only used if vlans have been registered to the adapter structure.
[ This fixes bugzilla entry 15582 -Eric Dumazet]
It matters if CONFIGPCIIOV is enabled, e.g. grep -ir SRIOV drivers/net/igb/.
Upstream commit: http://git.kernel.org/linus/31b24b95
References: https://bugzilla.kernel.org/showbug.cgi?id=15582
Other sources
The igbreceiveskb function in drivers/net/igb/igbmain.c in the Intel Gigabit Ethernet (aka igb) subsystem in the Linux kernel before 2.6.34, when Single Root I/O Virtualization (SR-IOV) and promiscuous mode are enabled but no VLANs are registered, allows remote attackers to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact via a VLAN tagged frame.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4263?
CVE-2010-4263 has a medium severity rating due to its potential to cause denial of service through null pointer dereference.
How do I fix CVE-2010-4263?
To fix CVE-2010-4263, backport upstream commit 31b24b95 to your system to ensure vlan_gro_receive is only used with registered VLANs.
Which software is affected by CVE-2010-4263?
CVE-2010-4263 affects several versions of the Linux Kernel and VMware ESX/ESXi, specifically multiple versions up to 4.1.
What is the impact of CVE-2010-4263?
The impact of CVE-2010-4263 may lead to system crashes or unresponsive states due to the null pointer dereference when handling VLAN packets.
Is there a patch available for CVE-2010-4263?
Yes, there is a patch available that includes a backported commit to mitigate the vulnerability in affected systems.