CVE-2024-40999: linux kernel from 4.9 (inclusive), before 6.9.7 (exclusive); +1 more affected products

Affected technology

linux kernel · from 4.9 (inclusive), before 6.9.7 (exclusive)
linux

Linux · 1738cd3ed342294360d6a74d4e58800004bff854 to before edb9a302cc9386142beffe5d9bbe4bfd36999eee, 1738cd3ed342294360d6a74d4e58800004bff854 to before 42146ee5286f16f1674a84f7c274dcca65c6ff2e, 1738cd3ed342294360d6a74d4e58800004bff854 to before b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7
Linux

Linux · 4.9
Linux

Component: Not specified by the source
File: drivers/net/ethernet/amazon/ena/ena_eth_com.c, drivers/net/ethernet/amazon/ena/ena_netdev.c, drivers/net/ethernet/amazon/ena/ena_regs_defs.h

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.