Linux kernel (drivers/infiniband/hw/bnxt_re): Collecting hardware counters writes doorbell-pacing statistics into a

CVSS 7.8CVE-2024-50158Firmware, BMC & network fabriccurated

Impact

Collecting hardware counters writes doorbell-pacing statistics into a stats buffer that was never sized for them on adapters outside GenP5/P7, producing an 8-byte slab out-of-bounds write. KASAN caught it as a heap overflow; in practice an unprivileged reader of the counters corrupts neighbouring kernel slab objects on a node shared with other tenants.

Who can reach it

Local and unprivileged: reading the RDMA hardware counters (sysfs hw_counters, or an rdma statistic query) is enough to run the faulty parse. A tenant does not need a device node - counter exposure is wider than /dev/infiniband. Conditional on a Broadcom bnxt_re adapter that reports doorbell pacing while not being a GenP5/P7 part.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the out-of-bound check fix (commits 05c5fcc1869a / c11b9b03ea52). Interim: restrict access to RDMA counter surfaces (sysfs hw_counters, rdma netlink) from tenant namespaces on bnxt_re nodes.

References

https://git.kernel.org/stable/c/05c5fcc1869a08e36a29691699b6534e5a00a82b https://git.kernel.org/stable/c/c11b9b03ea5252898f91f3388c248f0dc47bda52 https://nvd.nist.gov/vuln/detail/CVE-2024-50158

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.