Linux kernel bnxt_en: integer overflow in bnxt_get_nvram_directory() can undersize an allocation

CVSS 5.5CVE-2023-53661Firmware, BMC & network fabriccurated

Impact

The NVRAM directory read path in the Broadcom NetXtreme (bnxt_en) driver computed an allocation size with an arithmetic expression that could overflow before being widened, so a large reported directory can produce a buffer smaller than the data written into it. The record scores this availability-only (C:N/I:N/A:H), i.e. a kernel crash rather than demonstrated data disclosure or privilege gain. On a GPU node that means an unplanned panic that takes every GPU on the host down with it and cannot be fixed without a reboot. The flaw was found by static analysis (SVACE), not reported as exploited, and the fix is a one-line change to use the overflow-checked multiplication macro.

Who can reach it

Local only. The caller needs the ability to drive the driver's NVRAM/EEPROM ethtool operations on a Broadcom NetXtreme NIC, which requires CAP_NET_ADMIN in the host network namespace - not reachable from an ordinary unprivileged GPU pod, but reachable from a privileged or CAP_NET_ADMIN container and from any local administrative tooling.

What to do

Pick up the fixed stable kernel (commits 17e0453a7523, 7c6dddc239ab, d5eaf2a6b077, efb1a2575134 on their respective branches) from your distribution and reboot. There is no module-reload or runtime mitigation for an in-tree driver fix, so this rides along with the next kernel maintenance window; given the privilege required and the availability-only impact, it does not justify an emergency drain on its own.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-53661 https://git.kernel.org/stable/c/17e0453a7523ad7a25bb47af941b150a6c66d7b6 https://git.kernel.org/stable/c/efb1a257513438d43f4335f09b2f684e8167cad2

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.