Linux kernel (drivers/infiniband/hw/bnxt_re): Building the two-level page list for a large RDMA resource assumes

CVSS 7.8CVE-2024-50208Firmware, BMC & network fabriccurated

Impact

Building the two-level page list for a large RDMA resource assumes multiple page-directory pages where the hardware only has one, so past 256K page-list entries the driver writes into memory it does not own. A tenant that asks for a big enough queue or resource turns a normal allocation into kernel heap corruption on a shared node.

Who can reach it

Local: a tenant holding /dev/infiniband/uverbs* on a Broadcom bnxt_re adapter reaches it by creating a non-MR resource large enough to need more than 256K page-list entries (very deep queues / very large mappings). No fabric peer needed. Conditional on bnxt_re hardware.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the Level-2 PBL fix (commits df6fed0a2a1a / de5857fa7bcc). Interim: cap per-tenant RDMA resource limits, or remove /dev/infiniband from containers that do not need native verbs on bnxt_re nodes.

References

https://git.kernel.org/stable/c/df6fed0a2a1a5e57f033bca40dc316b18e0d0ce6 https://git.kernel.org/stable/c/de5857fa7bcc9a496a914c7e21390be873109f26 https://nvd.nist.gov/vuln/detail/CVE-2024-50208

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.