CVE-2024-38540

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq

Undefined behavior is triggered when bnxt_qplib_alloc_init_hwq is called

with hwq_attr->aux_depth != 0 and hwq_attr->aux_stride == 0.

In that case, "roundup_pow_of_two(hwq_attr->aux_stride)" gets called.

roundup_pow_of_two is documented as undefined for 0.

Fix it in the one caller that had this combination.

The undefined behavior was detected by UBSAN:

UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13

shift exponent 64 is too large for 64-bit type 'long unsigned int'

CPU: 24 PID: 1075 Comm: (udev-worker) Not tainted 6.9.0-rc6+ #4

Hardware name: Abacus electric, s.r.o. - [email protected] Super Server/H12SSW-iN, BIOS 2.7 10/25/2023

Call Trace:

<TASK>

dump_stack_lvl+0x5d/0x80

ubsan_epilogue+0x5/0x30

__ubsan_handle_shift_out_of_bounds.cold+0x61/0xec

__roundup_pow_of_two+0x25/0x35 [bnxt_re]

bnxt_qplib_alloc_init_hwq

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References