CVE-2024-44933

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()

A recent commit has modified the code in __bnxt_reserve_rings() to

set the default RSS indirection table to default only when the number

of RX rings is changing. While this works for newer firmware that

requires RX ring reservations, it causes the regression on older

firmware not requiring RX ring resrvations (BNXT_NEW_RM() returns

false).

With older firmware, RX ring reservations are not required and so

hw_resc->resv_rx_rings is not always set to the proper value. The

comparison:

if (old_rx_rings != bp->hw_resc.resv_rx_rings)

in __bnxt_reserve_rings() may be false even when the RX rings are

changing. This will cause __bnxt_reserve_rings() to skip setting

the default RSS indirection table to default to match the current

number of RX rings. This may later cause bnxt_fill_hw_rss_tbl() to

use an out-of-range index.

We already have bnxt_check_rss_tbl_no

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References