Linux kernel (drivers/infiniband/hw/bnxt_re): The driver advertises support for 13 scatter-gather entries per work

CVSS 9.8CVE-2024-57936Firmware, BMC & network fabriccurated

Impact

The driver advertises support for 13 scatter-gather entries per work request while its internal WQE structure only holds 6, so a tenant that posts a legal large-SGE send writes past the end of the WQE and corrupts adjacent kernel memory. Reported upstream as traffic failures and system crashes - this is attacker-shaped heap corruption from an ordinary verbs post_send.

Who can reach it

Any tenant container holding /dev/infiniband/uverbs* on a Broadcom Gen P7 bnxt_re adapter can trigger it by posting a send work request with more than 6 SGEs - the count the stack is told is legal. No fabric peer or privilege is required; the overflow happens on the local post path. Only applies where bnxt_re Gen P7 hardware is deployed.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the max-SGE fix (commits 3de1b50f055d / 9a479088e0c8). Interim: remove /dev/infiniband device nodes from tenant containers on bnxt_re Gen P7 nodes, or drain those nodes of untrusted tenants until patched.

References

https://git.kernel.org/stable/c/3de1b50f055dc2ca7072a526cdda21f691c22dd9 https://git.kernel.org/stable/c/9a479088e0c8f6140b8c7752b563bc8c6c6dcc8c https://nvd.nist.gov/vuln/detail/CVE-2024-57936

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.