CVE-2024-40999
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In the Linux kernel, in the ena network driver, validation for completion descriptors consistency has been added. It checks that the 'first' flag is set only for the first descriptor in multi-buffer packets. In case of an invalid descriptor, a reset will occur, and a new reset reason for RX data corruption has been added.
Risk Assessment
Lack of validation could lead to incorrect packet processing, potentially resulting in data corruption or system crashes. The fix improves driver reliability.
Recommendation
It is recommended to update the Linux kernel to a version with the fix to ensure proper operation of the ena driver and avoid potential issues.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: ena: Add validation for completion descriptors consistency Validate that `first` flag is set only for the first descriptor in multi-buffer packets. In case of an invalid descriptor, a reset will occur. A new reset reason for RX data corruption has been added.