Vulnerability vector:
- Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:H
- Severity (CVSSv4.0): 8.2 (high)
Description:
The vulnerability was identified in Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family , versions 231.1.162.1 (package version), 1.10.3 (hwrm spec).
The discovered vulnerability is related to stack-based buffer overflow. This leads to arbitrary code execution on the KONG core and the possibility of compromising the entire networking adapter or even other virtual machines/hypervisors.
In addition, a similar stack-based buffer overflow was identified in the ChiMP core, which can result in a complete failure of the networking adapter.
Vulnerability status: Confirmed by vendor
Date of vulnerability remediation: 10.04.2025
Recommendations:
- Update the firmware to 2.33 or higher
Researcher: Alexey Kovrizhnykh (Positive Technologies)