Read the docs
TI-2015-08112 Aliases CVE-2015-1142857GHSA-f496-vgq6-3hm4

On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow…

Priority MEDIUM 41CWE-254Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.

Summary

On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. This includes Linux kernel ixgbe driver before commit f079fa005aae08ee0e1bc32699874ff4f02e11c1, the Linux Kernel i40e/i40evf driver before e7358f54a3954df16d4f87e3cad35063f1c17de5 and the DPDK before commit 3f12b9f23b6499ff66ec8b0de941fb469297e5d0, additionally Multiple vendor NIC firmware is affected.

Why it matters now

EPSS 0.02109 81st percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:o:intel:x710_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:h:intel:x710:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:82599_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:h:intel:82599:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:x540_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:h:intel:x540:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:i350_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:h:intel:i350:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:82576_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:h:intel:82576:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
  • cpe:2.3:o:intel:x710_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:h:intel:x710:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:82599_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:h:intel:82599:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:x540_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:h:intel:x540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:i350_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:h:intel:i350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:82576_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:h:intel:82576:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel_ixgbe:-:*:*:*:*:*:*:*not specified by NVDVulnerableLinux
cpe:2.3:o:linux:linux_kernel_i40e\/i40evf:-:*:*:*:*:*:*:*not specified by NVDVulnerableLinux
cpe:2.3:o:dpdk:dpdk:-:*:*:*:*:*:*:*not specified by NVDVulnerableDPDK
  • cpe:2.3:o:linux:linux_kernel_ixgbe:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel_i40e\/i40evf:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Linux
  • cpe:2.3:o:dpdk:dpdk:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·DPDK

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)AffectedNo fix planned: Will not fix
Red Hat Enterprise MRG 2AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 8 (Liberty)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 9 (Mitaka)AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-1142857
  2. 2026-10-03 Alias added: GHSA-f496-vgq6-3hm4

References

Patch 1

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences