Intel® Ethernet Linux Driver Advisory

Summary:

Potential security vulnerabilities in some Intel® Ethernet Controllers X722 and 800 series Linux drivers may allow denial of service, escalation of privilege or information disclosure. Intel is releasing software driver updates to mitigate these potential vulnerabilities.

Vulnerability Details:

CVEID: CVE-2021-0084

Description: Improper input validation in the Intel® Ethernet Controllers X722 and 800 series Linux RMDA driver before version 1.3.19 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score: 8.8 High

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H****

CVEID: CVE-2021-0002

Description: Improper conditions check in some Intel® Ethernet Controllers 800 series Linux drivers before version 1.4.11 may allow an authenticated user to potentially enable information disclosure or denial of service via local access.

CVSS Base Score: 4.4 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

CVEID: CVE-2021-0003

Description: Improper conditions check in some Intel® Ethernet Controllers 800 series Linux drivers before version 1.4.11 may allow an authenticated user to potentially enable information disclosure via local access.

CVSS Base Score: 3.8 Low

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Affected Products:

Intel® Ethernet Controllers X722 and 800 series before Linux RMDA driver version 1.3.19.

Intel® Ethernet Controllers 800 series Linux driver before version 1.4.11.

Recommendations:

Intel recommends updating Intel® Ethernet Controllers X722 and 800 series drivers to the latest versions.****

Updates are available for download at this location:

<https://www.intel.com/content/www/us/en/support/products/36773/ethernet-products.html&gt;

Acknowledgements:

CVE-2021-0084 was found externally. CVE-2021-0002 and CVE-2021-0003 were found internally by Intel employees.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.