In the Linux kernel, the following vulnerability has been resolved:
i40e: Do not allow untrusted VF to remove administratively set MAC
Currently when PF administratively sets VF's MAC address and the VF is put down (VF tries to delete all MACs) then the MAC is removed from MAC filters and primary VF MAC is zeroed.
Do not allow untrusted VF to remove primary MAC when it was set administratively by PF.
Reproducer: 1) Create VF 2) Set VF interface up 3) Administratively set the VF's MAC 4) Put VF interface down
[root@host ~]# echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs [root@host ~]# ip link set enp2s0f0v0 up [root@host ~]# ip link set enp2s0f0 vf 0 mac fe:6c:b5:da:c7:7d [root@host ~]# ip link show enp2s0f0 23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff vf 0 link/ether fe:6c:b5:da:c7:7d brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off [root@host ~]# ip link set enp2s0f0v0 down [root@host ~]# ip link show enp2s0f0 23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff vf 0 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
[
    {
        "id": "CVE-2024-26830-1b341884",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c",
            "function": "i40e_vc_del_mac_addr_msg"
        },
        "digest": {
            "function_hash": "45306595223266606926601663791383184368",
            "length": 1687.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c981792e4ccbc134b468797acdd7781959e6893"
    },
    {
        "id": "CVE-2024-26830-5137de56",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c",
            "function": "i40e_check_vf_permission"
        },
        "digest": {
            "function_hash": "202783052343744430552727675720059354110",
            "length": 1417.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73d9629e1c8c1982f13688c4d1019c3994647ccc"
    },
    {
        "id": "CVE-2024-26830-6231f19a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c",
            "function": "i40e_check_vf_permission"
        },
        "digest": {
            "function_hash": "202783052343744430552727675720059354110",
            "length": 1417.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d250a81ba813a93563be68072c563aa1e346346d"
    },
    {
        "id": "CVE-2024-26830-6e90d7b8",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c",
            "function": "i40e_check_vf_permission"
        },
        "digest": {
            "function_hash": "202783052343744430552727675720059354110",
            "length": 1417.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be147926140ac48022c9605d7ab0a67387e4b404"
    },
    {
        "id": "CVE-2024-26830-8015aa05",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c",
            "function": "i40e_check_vf_permission"
        },
        "digest": {
            "function_hash": "274004888241899273586639976177616207549",
            "length": 1434.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c981792e4ccbc134b468797acdd7781959e6893"
    },
    {
        "id": "CVE-2024-26830-a1b220e6",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
        },
        "digest": {
            "line_hashes": [
                "106413830839733194670131623981529048361",
                "168761651918166742059660964123933863756",
                "53537144581157847383047874827696015634",
                "328705899325322377432004692671026841393",
                "100622142390607875686492650374141979324",
                "33285431332152869951177861210679379533",
                "99147375903756648411529402141220426385",
                "11457782112484673624204227087120019544",
                "189947867756718119429202679603002598582",
                "235875026528283670944819034123377284144",
                "333291793151677298614968197318875813866",
                "75186556935545238665745761818522780736",
                "181342064768053281741286865139887439074",
                "281775020970079186872955068684810096055",
                "114360928565777394532150930320079059242",
                "131574819841765915531633682918980397247",
                "182281767888846332941683661732037271989",
                "318674351589609725172127480114175089922",
                "88472290078574491376741731800109649788",
                "335875922587520344168667201965271421046",
                "82731968384305702227949195160205188043",
                "280519640831124960930971946092399946076"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be147926140ac48022c9605d7ab0a67387e4b404"
    },
    {
        "id": "CVE-2024-26830-b2f2f7af",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
        },
        "digest": {
            "line_hashes": [
                "106413830839733194670131623981529048361",
                "168761651918166742059660964123933863756",
                "53537144581157847383047874827696015634",
                "328705899325322377432004692671026841393",
                "100622142390607875686492650374141979324",
                "33285431332152869951177861210679379533",
                "99147375903756648411529402141220426385",
                "11457782112484673624204227087120019544",
                "189947867756718119429202679603002598582",
                "235875026528283670944819034123377284144",
                "333291793151677298614968197318875813866",
                "75186556935545238665745761818522780736",
                "181342064768053281741286865139887439074",
                "281775020970079186872955068684810096055",
                "114360928565777394532150930320079059242",
                "131574819841765915531633682918980397247",
                "182281767888846332941683661732037271989",
                "318674351589609725172127480114175089922",
                "88472290078574491376741731800109649788",
                "335875922587520344168667201965271421046",
                "82731968384305702227949195160205188043",
                "280519640831124960930971946092399946076"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73d9629e1c8c1982f13688c4d1019c3994647ccc"
    },
    {
        "id": "CVE-2024-26830-c2e6832f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c",
            "function": "i40e_vc_del_mac_addr_msg"
        },
        "digest": {
            "function_hash": "171373385646316137680545446217329375704",
            "length": 1706.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73d9629e1c8c1982f13688c4d1019c3994647ccc"
    },
    {
        "id": "CVE-2024-26830-e31b3137",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
        },
        "digest": {
            "line_hashes": [
                "106413830839733194670131623981529048361",
                "168761651918166742059660964123933863756",
                "53537144581157847383047874827696015634",
                "328705899325322377432004692671026841393",
                "100622142390607875686492650374141979324",
                "33285431332152869951177861210679379533",
                "99147375903756648411529402141220426385",
                "11457782112484673624204227087120019544",
                "189947867756718119429202679603002598582",
                "235875026528283670944819034123377284144",
                "333291793151677298614968197318875813866",
                "75186556935545238665745761818522780736",
                "181342064768053281741286865139887439074",
                "281775020970079186872955068684810096055",
                "114360928565777394532150930320079059242",
                "131574819841765915531633682918980397247",
                "182281767888846332941683661732037271989",
                "318674351589609725172127480114175089922",
                "88472290078574491376741731800109649788",
                "335875922587520344168667201965271421046",
                "82731968384305702227949195160205188043",
                "280519640831124960930971946092399946076"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d250a81ba813a93563be68072c563aa1e346346d"
    },
    {
        "id": "CVE-2024-26830-e91bab19",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
        },
        "digest": {
            "line_hashes": [
                "106413830839733194670131623981529048361",
                "168761651918166742059660964123933863756",
                "53537144581157847383047874827696015634",
                "148957009335213105537298449169500282707",
                "72679930961620154098764363147935677449",
                "33285431332152869951177861210679379533",
                "99147375903756648411529402141220426385",
                "11457782112484673624204227087120019544",
                "270986236567173021038013183981814867065",
                "235875026528283670944819034123377284144",
                "333291793151677298614968197318875813866",
                "75186556935545238665745761818522780736",
                "181342064768053281741286865139887439074",
                "281775020970079186872955068684810096055",
                "114360928565777394532150930320079059242",
                "201184842565991490597034963312627086861",
                "336606954879809014966826002218817038505",
                "259133339068272029355494073061876480387",
                "191258505248320387712275306890123863909",
                "335875922587520344168667201965271421046",
                "318996003637464674053234258072507882879",
                "217442538973903824897641156866038453260"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c981792e4ccbc134b468797acdd7781959e6893"
    },
    {
        "id": "CVE-2024-26830-ef0ea2b8",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c",
            "function": "i40e_vc_del_mac_addr_msg"
        },
        "digest": {
            "function_hash": "171373385646316137680545446217329375704",
            "length": 1706.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be147926140ac48022c9605d7ab0a67387e4b404"
    },
    {
        "id": "CVE-2024-26830-f9831e24",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c",
            "function": "i40e_vc_del_mac_addr_msg"
        },
        "digest": {
            "function_hash": "171373385646316137680545446217329375704",
            "length": 1706.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d250a81ba813a93563be68072c563aa1e346346d"
    }
]