CVE-2024-42148

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bnx2x: Fix multiple UBSAN array-index-out-of-bounds

Fix UBSAN warnings that occur when using a system with 32 physical

cpu cores or more, or when the user defines a number of Ethernet

queues greater than or equal to FP_SB_MAX_E1x using the num_queues

module parameter.

Currently there is a read/write out of bounds that occurs on the array

"struct stats_query_entry query" present inside the "bnx2x_fw_stats_req"

struct in "drivers/net/ethernet/broadcom/bnx2x/bnx2x.h".

Looking at the definition of the "struct stats_query_entry query" array:

struct stats_query_entry query[FP_SB_MAX_E1x+

BNX2X_FIRST_QUEUE_QUERY_IDX];

FP_SB_MAX_E1x is defined as the maximum number of fast path interrupts and

has a value of 16, while BNX2X_FIRST_QUEUE_QUERY_IDX has a value of 3

meaning the array has a total size of 19.

Since accesses to "struct stats_query_entry query" are offset-ted by

BNX2X_FIRST_QUEUE_QUERY_IDX, that means tha

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References