CVE-2024-26830

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26830", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.181Z", "datePublished": "2024-04-17T09:43:53.643Z", "dateUpdated": "2026-08-05T11:27:42.789Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:42.789Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Do not allow untrusted VF to remove administratively set MAC\n\nCurrently when PF administratively sets VF's MAC address and the VF\nis put down (VF tries to delete all MACs) then the MAC is removed\nfrom MAC filters and primary VF MAC is zeroed.\n\nDo not allow untrusted VF to remove primary MAC when it was set\nadministratively by PF.\n\nReproducer:\n1) Create VF\n2) Set VF interface up\n3) Administratively set the VF's MAC\n4) Put VF interface down\n\n[root@host ~]# echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs\n[root@host ~]# ip link set enp2s0f0v0 up\n[root@host ~]# ip link set enp2s0f0 vf 0 mac fe:6c:b5:da:c7:7d\n[root@host ~]# ip link show enp2s0f0\n23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000\n link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff\n vf 0 link/ether fe:6c:b5:da:c7:7d brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off\n[root@host ~]# ip link set enp2s0f0v0 down\n[root@host ~]# ip link show enp2s0f0\n23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000\n link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff\n vf 0 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker must drive the i40e VF's virtchnl mailbox (PCIe admin queue) from the OS that owns the VF \u2014 a guest VM with the VF passed through, or a container/pod holding the VF netdev \u2014 which is local access to the host, not a network protocol.\nAC:L - A single VIRTCHNL_OP_DEL_ETH_ADDR message, or literally `ip link set eth0 down` in the guest, deterministically deletes the filter and zeroes vf->default_lan_addr with no race, timing, or memory-layout condition; the administratively-set MAC is the configuration in which the control exists at all, not an attacker-uncontrolled precondition.\nPR:L - The attacker needs only the low-privileged resource the host deliberately grants an *untrusted* VF plus CAP_NET_ADMIN over that netdev, which a container root holds in its own netns under the standard SR-IOV CNI deployment; no host root and no trusted-VF flag are required.\nUI:N - The VF acts entirely on its own \u2014 iavf_down() emits the delete request automatically, and a hostile VF driver can send it at will with no action by the host administrator or any other user.\nS:C - The exploiting principal is the guest/tenant that owns the VF, while the resource destroyed is the hypervisor-administrator-managed VF MAC policy held in the host's PF driver, so an untrusted VM/container defeats a restriction imposed by a different security authority \u2014 the SR-IOV isolation boundary CVSS cites as a scope change.\nC:N - No memory is read out of bounds and no host state is disclosed to the VF; removing a MAC filter reduces what the VF receives rather than exposing traffic or kernel data, and promiscuous mode remains gated on the trusted flag.\nI:H - An explicitly untrusted VF performs an unauthorized modification of host-owned configuration, erasing the PF's authoritative record of the assigned MAC (ip link reports 00:00:00:00:00:00) and removing the hardware filter, which is a complete loss of the ndo_set_vf_mac protection for that VF \u2014 a direct, serious consequence to the control the impacted component provides.\nA:H - Because pf_set_mac remains set while default_lan_addr is zeroed, every subsequent unicast MAC add returns -EPERM even after VF reset or driver reload, so the VF's networking is totally and persistently dead and the host-owned device stays unusable \u2014 including for any tenant later assigned that VF \u2014 until an administrator manually re-issues the MAC assignment."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"], "versions": [{"version": "700bbf6c1f9e4ab055528d5ab4ac5815fe4a6c1b", "lessThan": "1c981792e4ccbc134b468797acdd7781959e6893", "status": "affected", "versionType": "git"}, {"version": "700bbf6c1f9e4ab055528d5ab4ac5815fe4a6c1b", "lessThan": "be147926140ac48022c9605d7ab0a67387e4b404", "status": "affected", "versionType": "git"}, {"version": "700bbf6c1f9e4ab055528d5ab4ac5815fe4a6c1b", "lessThan": "d250a81ba813a93563be68072c563aa1e346346d", "status": "affected", "versionType": "git"}, {"version": "700bbf6c1f9e4ab055528d5ab4ac5815fe4a6c1b", "lessThan": "73d9629e1c8c1982f13688c4d1019c3994647ccc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"], "versions": [{"version": "3.14", "status": "affected"}, {"version": "0", "lessThan": "3.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.79", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.18", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.6", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.1.79"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.6.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.7.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1c981792e4ccbc134b468797acdd7781959e6893"}, {"url": "https://git.kernel.org/stable/c/be147926140ac48022c9605d7ab0a67387e4b404"}, {"url": "https://git.kernel.org/stable/c/d250a81ba813a93563be68072c563aa1e346346d"}, {"url": "https://git.kernel.org/stable/c/73d9629e1c8c1982f13688c4d1019c3994647ccc"}], "title": "i40e: Do not allow untrusted VF to remove administratively set MAC", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T17:41:40.871945Z", "id": "CVE-2024-26830", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T17:48:41.487Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.591Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/1c981792e4ccbc134b468797acdd7781959e6893", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/be147926140ac48022c9605d7ab0a67387e4b404", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d250a81ba813a93563be68072c563aa1e346346d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/73d9629e1c8c1982f13688c4d1019c3994647ccc", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/1c981792e4ccbc134b468797acdd7781959e6893", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/be147926140ac48022c9605d7ab0a67387e4b404", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d250a81ba813a93563be68072c563aa1e346346d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/73d9629e1c8c1982f13688c4d1019c3994647ccc", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.591Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26830", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-17T17:41:40.871945Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T17:41:42.323Z"}}], "cna": {"title": "i40e: Do not allow untrusted VF to remove administratively set MAC", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker must drive the i40e VF's virtchnl mailbox (PCIe admin queue) from the OS that owns the VF \u2014 a guest VM with the VF passed through, or a container/pod holding the VF netdev \u2014 which is local access to the host, not a network protocol.\nAC:L - A single VIRTCHNL_OP_DEL_ETH_ADDR message, or literally `ip link set eth0 down` in the guest, deterministically deletes the filter and zeroes vf->default_lan_addr with no race, timing, or memory-layout condition; the administratively-set MAC is the configuration in which the control exists at all, not an attacker-uncontrolled precondition.\nPR:L - The attacker needs only the low-privileged resource the host deliberately grants an *untrusted* VF plus CAP_NET_ADMIN over that netdev, which a container root holds in its own netns under the standard SR-IOV CNI deployment; no host root and no trusted-VF flag are required.\nUI:N - The VF acts entirely on its own \u2014 iavf_down() emits the delete request automatically, and a hostile VF driver can send it at will with no action by the host administrator or any other user.\nS:C - The exploiting principal is the guest/tenant that owns the VF, while the resource destroyed is the hypervisor-administrator-managed VF MAC policy held in the host's PF driver, so an untrusted VM/container defeats a restriction imposed by a different security authority \u2014 the SR-IOV isolation boundary CVSS cites as a scope change.\nC:N - No memory is read out of bounds and no host state is disclosed to the VF; removing a MAC filter reduces what the VF receives rather than exposing traffic or kernel data, and promiscuous mode remains gated on the trusted flag.\nI:H - An explicitly untrusted VF performs an unauthorized modification of host-owned configuration, erasing the PF's authoritative record of the assigned MAC (ip link reports 00:00:00:00:00:00) and removing the hardware filter, which is a complete loss of the ndo_set_vf_mac protection for that VF \u2014 a direct, serious consequence to the control the impacted component provides.\nA:H - Because pf_set_mac remains set while default_lan_addr is zeroed, every subsequent unicast MAC add returns -EPERM even after VF reset or driver reload, so the VF's networking is totally and persistently dead and the host-owned device stays unusable \u2014 including for any tenant later assigned that VF \u2014 until an administrator manually re-issues the MAC assignment."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "700bbf6c1f9e4ab055528d5ab4ac5815fe4a6c1b", "lessThan": "1c981792e4ccbc134b468797acdd7781959e6893", "versionType": "git"}, {"status": "affected", "version": "700bbf6c1f9e4ab055528d5ab4ac5815fe4a6c1b", "lessThan": "be147926140ac48022c9605d7ab0a67387e4b404", "versionType": "git"}, {"status": "affected", "version": "700bbf6c1f9e4ab055528d5ab4ac5815fe4a6c1b", "lessThan": "d250a81ba813a93563be68072c563aa1e346346d", "versionType": "git"}, {"status": "affected", "version": "700bbf6c1f9e4ab055528d5ab4ac5815fe4a6c1b", "lessThan": "73d9629e1c8c1982f13688c4d1019c3994647ccc", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.14"}, {"status": "unaffected", "version": "0", "lessThan": "3.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.79", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.18", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.6", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1c981792e4ccbc134b468797acdd7781959e6893"}, {"url": "https://git.kernel.org/stable/c/be147926140ac48022c9605d7ab0a67387e4b404"}, {"url": "https://git.kernel.org/stable/c/d250a81ba813a93563be68072c563aa1e346346d"}, {"url": "https://git.kernel.org/stable/c/73d9629e1c8c1982f13688c4d1019c3994647ccc"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Do not allow untrusted VF to remove administratively set MAC\n\nCurrently when PF administratively sets VF's MAC address and the VF\nis put down (VF tries to delete all MACs) then the MAC is removed\nfrom MAC filters and primary VF MAC is zeroed.\n\nDo not allow untrusted VF to remove primary MAC when it was set\nadministratively by PF.\n\nReproducer:\n1) Create VF\n2) Set VF interface up\n3) Administratively set the VF's MAC\n4) Put VF interface down\n\n[root@host ~]# echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs\n[root@host ~]# ip link set enp2s0f0v0 up\n[root@host ~]# ip link set enp2s0f0 vf 0 mac fe:6c:b5:da:c7:7d\n[root@host ~]# ip link show enp2s0f0\n23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000\n link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff\n vf 0 link/ether fe:6c:b5:da:c7:7d brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off\n[root@host ~]# ip link set enp2s0f0v0 down\n[root@host ~]# ip link show enp2s0f0\n23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000\n link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff\n vf 0 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.79", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.18", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.6", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "3.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:42.789Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26830", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:27:42.789Z", "dateReserved": "2024-02-19T14:20:24.181Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-17T09:43:53.643Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1c981792e4ccbc134b468797acdd7781959e6893", "status": "affected", "version": "700bbf6c1f9e4ab055528d5ab4ac5815fe4a6c1b", "versionType": "git"}, {"lessThan": "be147926140ac48022c9605d7ab0a67387e4b404", "status": "affected", "version": "700bbf6c1f9e4ab055528d5ab4ac5815fe4a6c1b", "versionType": "git"}, {"lessThan": "d250a81ba813a93563be68072c563aa1e346346d", "status": "affected", "version": "700bbf6c1f9e4ab055528d5ab4ac5815fe4a6c1b", "versionType": "git"}, {"lessThan": "73d9629e1c8c1982f13688c4d1019c3994647ccc", "status": "affected", "version": "700bbf6c1f9e4ab055528d5ab4ac5815fe4a6c1b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.14"}, {"lessThan": "3.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.79", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.18", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "599DCB8B-CC77-44F1-A6BD-8DEFA336D400", "versionEndExcluding": "6.1.79", "versionStartIncluding": "3.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD961E49-FEDA-47CF-BF23-4D2BD942B4E0", "versionEndExcluding": "6.6.18", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6D6A5C8-7308-42A9-8A72-ABF3DEA4BB82", "versionEndExcluding": "6.7.6", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*", "matchCriteriaId": "62075ACE-B2A0-4B16-829D-B3DA5AE5CC41", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Do not allow untrusted VF to remove administratively set MAC\n\nCurrently when PF administratively sets VF's MAC address and the VF\nis put down (VF tries to delete all MACs) then the MAC is removed\nfrom MAC filters and primary VF MAC is zeroed.\n\nDo not allow untrusted VF to remove primary MAC when it was set\nadministratively by PF.\n\nReproducer:\n1) Create VF\n2) Set VF interface up\n3) Administratively set the VF's MAC\n4) Put VF interface down\n\n[root@host ~]# echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs\n[root@host ~]# ip link set enp2s0f0v0 up\n[root@host ~]# ip link set enp2s0f0 vf 0 mac fe:6c:b5:da:c7:7d\n[root@host ~]# ip link show enp2s0f0\n23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000\n link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff\n vf 0 link/ether fe:6c:b5:da:c7:7d brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off\n[root@host ~]# ip link set enp2s0f0v0 down\n[root@host ~]# ip link show enp2s0f0\n23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000\n link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff\n vf 0 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i40e: No permitir que VF que no es de confianza elimine la MAC configurada administrativamente. Actualmente, cuando PF configura administrativamente la direcci\u00f3n MAC de VF y el VF se desactiva (VF intenta eliminar todas las MAC), entonces la MAC se eliminado de los filtros MAC y el MAC VF primario se pone a cero. No permita que VF que no es de confianza elimine la MAC principal cuando PF la configur\u00f3 administrativamente. Reproductor: 1) Crear VF 2) Configurar la interfaz VF 3) Configurar administrativamente la MAC del VF 4) Colocar la interfaz VF [root@host ~]# echo 1 &gt; /sys/class/net/enp2s0f0/device/sriov_numvfs [root@ host ~]# enlace ip establecido enp2s0f0v0 up [root@host ~]# enlace ip establecido enp2s0f0 vf 0 mac fe:6c:b5:da:c7:7d [root@host ~]# enlace ip show enp2s0f0 23: enp2s0f0: &lt; BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc mq estado Modo UP DEFAULT grupo predeterminado qlen 1000 enlace/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff vf 0 enlace/ ether fe:6c:b5:da:c7:7d brd ff:ff:ff:ff:ff:ff, verificaci\u00f3n de suplantaci\u00f3n de identidad activada, estado de enlace autom\u00e1tico, confianza desactivada [root@host ~]# enlace IP configurado enp2s0f0v0 inactivo [ra\u00edz @host ~]# ip link show enp2s0f0 23: enp2s0f0: mtu 1500 qdisc mq state Modo UP DEFAULT grupo predeterminado qlen 1000 link/ether 3c:ec:ef:b7:dd:04 brd ff :ff:ff:ff:ff:ff vf 0 enlace/\u00e9ter 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, verificaci\u00f3n de suplantaci\u00f3n de identidad activada, estado de enlace autom\u00e1tico, confianza desactivada"}], "id": "CVE-2024-26830", "lastModified": "2026-08-04T11:17:11.727", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 5.8, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26830", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-17T17:41:40.871945Z", "version": "2.0.3"}}]}, "published": "2024-04-17T10:15:09.400", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1c981792e4ccbc134b468797acdd7781959e6893"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/73d9629e1c8c1982f13688c4d1019c3994647ccc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/be147926140ac48022c9605d7ab0a67387e4b404"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d250a81ba813a93563be68072c563aa1e346346d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1c981792e4ccbc134b468797acdd7781959e6893"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/73d9629e1c8c1982f13688c4d1019c3994647ccc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/be147926140ac48022c9605d7ab0a67387e4b404"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d250a81ba813a93563be68072c563aa1e346346d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:3138", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-05-22T00:00:00Z"}, {"advisory": "RHSA-2024:8161", "cpe": "cpe:/o:redhat:rhel_aus:8.6", "package": "kernel-0:4.18.0-372.126.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-10-16T00:00:00Z"}, {"advisory": "RHSA-2024:8161", "cpe": "cpe:/o:redhat:rhel_tus:8.6", "package": "kernel-0:4.18.0-372.126.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-10-16T00:00:00Z"}, {"advisory": "RHSA-2024:8161", "cpe": "cpe:/o:redhat:rhel_e4s:8.6", "package": "kernel-0:4.18.0-372.126.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-10-16T00:00:00Z"}, {"advisory": "RHSA-2024:10941", "cpe": "cpe:/o:redhat:rhel_eus:8.8", "package": "kernel-0:4.18.0-477.83.1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:2394", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.13.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-30T00:00:00Z"}, {"advisory": "RHSA-2024:2394", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.13.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-30T00:00:00Z"}, {"advisory": "RHSA-2025:0063", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.99.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-01-08T00:00:00Z"}, {"advisory": "RHSA-2025:0064", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.99.1.rt14.384.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-01-08T00:00:00Z"}], "bugzilla": {"description": "kernel: i40e: Do not allow untrusted VF to remove administratively set MAC", "id": "2275596", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2275596"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ni40e: Do not allow untrusted VF to remove administratively set MAC\nCurrently when PF administratively sets VF's MAC address and the VF\nis put down (VF tries to delete all MACs) then the MAC is removed\nfrom MAC filters and primary VF MAC is zeroed.\nDo not allow untrusted VF to remove primary MAC when it was set\nadministratively by PF.\nReproducer:\n1) Create VF\n2) Set VF interface up\n3) Administratively set the VF's MAC\n4) Put VF interface down\n[root@host ~]# echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs\n[root@host ~]# ip link set enp2s0f0v0 up\n[root@host ~]# ip link set enp2s0f0 vf 0 mac fe:6c:b5:da:c7:7d\n[root@host ~]# ip link show enp2s0f0\n23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000\nlink/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff\nvf 0 link/ether fe:6c:b5:da:c7:7d brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off\n[root@host ~]# ip link set enp2s0f0v0 down\n[root@host ~]# ip link show enp2s0f0\n23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000\nlink/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff\nvf 0 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off", "A flaw was found in Intel network adapters in the Linux kernel, where untrusted virtualized network interfaces can remove MAC addresses set by the system. This flaw allows an attacker with sufficient privileges to cause a denial of service."], "name": "CVE-2024-26830", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26830\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26830\nhttps://lore.kernel.org/linux-cve-announce/2024041703-CVE-2024-26830-5bc0@gregkh/T"], "statement": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-20: Improper Input Validation vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\nRed Hat enforces the principle of least functionality, ensuring that only essential features, services, and ports are enabled. This minimizes the number of components that could be affected by input validation vulnerabilities. Security testing and evaluation standards are implemented within the environment to rigorously test input validation mechanisms during the development lifecycle, while static code analysis identifies potential input validation vulnerabilities by default. Process isolation ensures that processes handling potentially malicious or unvalidated inputs run in isolated environments by separating execution domains for each process. Malicious code protections, such as IPS/IDS and antimalware solutions, help detect and mitigate malicious payloads stemming from input validation vulnerabilities. Finally, robust input validation and error-handling mechanisms ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks further.", "threat_severity": "Moderate"}

{}