CVE-2024-53209

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix receive ring space parameters when XDP is active

The MTU setting at the time an XDP multi-buffer is attached

determines whether the aggregation ring will be used and the

rx_skb_func handler. This is done in bnxt_set_rx_skb_mode().

If the MTU is later changed, the aggregation ring setting may need

to be changed and it may become out-of-sync with the settings

initially done in bnxt_set_rx_skb_mode(). This may result in

random memory corruption and crashes as the HW may DMA data larger

than the allocated buffer size, such as:

BUG: kernel NULL pointer dereference, address: 00000000000003c0

PGD 0 P4D 0

Oops: 0000 [#1] PREEMPT SMP NOPTI

CPU: 17 PID: 0 Comm: swapper/17 Kdump: loaded Tainted: G S OE 6.1.0-226bf9805506 #1

Hardware name: Wiwynn Delta Lake PVT BZA.02601.0150/Delta Lake-Class1, BIOS F0E_3A12 08/26/2021

RIP: 0010:bnxt_rx_pkt+0xe97/0x1ae0 [bnxt_en]

Code: 8b 95 70 ff ff ff 4c 8b 9d 48

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References