CVE-2024-44933 (GCVE-0-2024-44933)

Vulnerability from cvelistv5 – Published: 2024-08-26 10:11 – Updated: 2026-08-05 11:37
VLAI
Title
bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()
Summary
In the Linux kernel, the following vulnerability has been resolved: bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl() A recent commit has modified the code in __bnxt_reserve_rings() to set the default RSS indirection table to default only when the number of RX rings is changing. While this works for newer firmware that requires RX ring reservations, it causes the regression on older firmware not requiring RX ring resrvations (BNXT_NEW_RM() returns false). With older firmware, RX ring reservations are not required and so hw_resc->resv_rx_rings is not always set to the proper value. The comparison: if (old_rx_rings != bp->hw_resc.resv_rx_rings) in __bnxt_reserve_rings() may be false even when the RX rings are changing. This will cause __bnxt_reserve_rings() to skip setting the default RSS indirection table to default to match the current number of RX rings. This may later cause bnxt_fill_hw_rss_tbl() to use an out-of-range index. We already have bnxt_check_rss_tbl_no_rmgr() to handle exactly this scenario. We just need to move it up in bnxt_need_reserve_rings() to be called unconditionally when using older firmware. Without the fix, if the TX rings are changing, we'll skip the bnxt_check_rss_tbl_no_rmgr() call and __bnxt_reserve_rings() may also skip the bnxt_set_dflt_rss_indir_tbl() call for the reason explained in the last paragraph. Without setting the default RSS indirection table to default, it causes the regression: BUG: KASAN: slab-out-of-bounds in __bnxt_hwrm_vnic_set_rss+0xb79/0xe40 Read of size 2 at addr ffff8881c5809618 by task ethtool/31525 Call Trace: __bnxt_hwrm_vnic_set_rss+0xb79/0xe40 bnxt_hwrm_vnic_rss_cfg_p5+0xf7/0x460 __bnxt_setup_vnic_p5+0x12e/0x270 __bnxt_open_nic+0x2262/0x2f30 bnxt_open_nic+0x5d/0xf0 ethnl_set_channels+0x5d4/0xb30 ethnl_default_set_doit+0x2f1/0x620
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: bc57f879a420d19bb5ecdb480f858371554f2258 , < abd573e9ad2ba64eaa6418a5f4eec819de28f205 (git)
Affected: 98ba1d931f611e8f8f519c0405fa0a1a76554bfa , < da03f5d1b2c319a2b74fe76edeadcd8fa5f44376 (git)
Create a notification for this product.
Linux Linux Affected: 6.10.4 , < 6.10.5 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44933",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:27:54.693041Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:56.097Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "abd573e9ad2ba64eaa6418a5f4eec819de28f205",
              "status": "affected",
              "version": "bc57f879a420d19bb5ecdb480f858371554f2258",
              "versionType": "git"
            },
            {
              "lessThan": "da03f5d1b2c319a2b74fe76edeadcd8fa5f44376",
              "status": "affected",
              "version": "98ba1d931f611e8f8f519c0405fa0a1a76554bfa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.10.5",
              "status": "affected",
              "version": "6.10.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.5",
                  "versionStartIncluding": "6.10.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()\n\nA recent commit has modified the code in __bnxt_reserve_rings() to\nset the default RSS indirection table to default only when the number\nof RX rings is changing.  While this works for newer firmware that\nrequires RX ring reservations, it causes the regression on older\nfirmware not requiring RX ring resrvations (BNXT_NEW_RM() returns\nfalse).\n\nWith older firmware, RX ring reservations are not required and so\nhw_resc-\u003eresv_rx_rings is not always set to the proper value.  The\ncomparison:\n\nif (old_rx_rings != bp-\u003ehw_resc.resv_rx_rings)\n\nin __bnxt_reserve_rings() may be false even when the RX rings are\nchanging.  This will cause __bnxt_reserve_rings() to skip setting\nthe default RSS indirection table to default to match the current\nnumber of RX rings.  This may later cause bnxt_fill_hw_rss_tbl() to\nuse an out-of-range index.\n\nWe already have bnxt_check_rss_tbl_no_rmgr() to handle exactly this\nscenario.  We just need to move it up in bnxt_need_reserve_rings()\nto be called unconditionally when using older firmware.  Without the\nfix, if the TX rings are changing, we\u0027ll skip the\nbnxt_check_rss_tbl_no_rmgr() call and __bnxt_reserve_rings() may also\nskip the bnxt_set_dflt_rss_indir_tbl() call for the reason explained\nin the last paragraph.  Without setting the default RSS indirection\ntable to default, it causes the regression:\n\nBUG: KASAN: slab-out-of-bounds in __bnxt_hwrm_vnic_set_rss+0xb79/0xe40\nRead of size 2 at addr ffff8881c5809618 by task ethtool/31525\nCall Trace:\n__bnxt_hwrm_vnic_set_rss+0xb79/0xe40\n bnxt_hwrm_vnic_rss_cfg_p5+0xf7/0x460\n __bnxt_setup_vnic_p5+0x12e/0x270\n __bnxt_open_nic+0x2262/0x2f30\n bnxt_open_nic+0x5d/0xf0\n ethnl_set_channels+0x5d4/0xb30\n ethnl_default_set_doit+0x2f1/0x620"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only trigger is a local `ethtool -L`/set-channels request delivered over an `AF_NETLINK` genetlink socket or the `SIOCETHTOOL` ioctl; no remote peer data reaches `bnxt_need_reserve_rings()`/`bnxt_fill_hw_rss_tbl_p5()`.\nAC:L - The attacker deterministically creates every precondition by simply reducing the channel count from a higher value (`ethtool -L ethX combined 1`), which changes TX rings and thus takes the early `return true` that skips `bnxt_check_rss_tbl_no_rmgr()`; the stale default table then indexes `bp-\u003erx_ring[]` out of range on the very next `bnxt_open_nic()`. No race, no memory-layout luck, and the attacker also chooses the overread distance by picking the starting and ending ring counts.\nPR:L - Both entry points gate only on `CAP_NET_ADMIN` evaluated against the netns owner\u0027s user namespace (`GENL_UNS_ADMIN_PERM`/`ns_capable(net-\u003euser_ns, ...)`), not real root; a bnxt VF handed to a container or pod netns is administered by an otherwise unprivileged principal who holds that capability locally.\nUI:N - The attacker issues the channel-count change from its own process and the out-of-bounds access happens synchronously in that syscall; no victim action or cooperation is involved.\nS:U - The overread and the resulting misprogramming occur entirely within the kernel\u0027s own security authority on the same PCI function; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `rxr = \u0026bp-\u003erx_ring[j]` with `j` up to the previous ring count reads `fw_ring_id` at attacker-selected offsets tens of kilobytes beyond a `kcalloc()`ed array \u2014 far more than a strictly bounded few-byte overread \u2014 and the harvested kernel heap words are programmed into the hardware RSS table, whose steering effect is observable through per-ring `ethtool -S` counters, yielding an oracle on adjacent kernel memory.\nI:L - There is no out-of-bounds write, but the values scavenged from unrelated kernel memory are committed to the NIC via `HWRM_VNIC_RSS_CFG`, corrupting the device\u0027s RX steering configuration with ring IDs neither the kernel nor the administrator intended.\nA:H - The read runs ~75 KB past a small slab object, producing a KASAN slab-out-of-bounds report (panic under `panic_on_warn`/KASAN panic) and a plausible page-fault oops on unmapped memory; even when it survives, the bogus ring IDs make `HWRM_VNIC_RSS_CFG` fail and `__bnxt_open_nic()` abort, leaving the interface down, and the sequence is cheap and repeatable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:06.259Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/abd573e9ad2ba64eaa6418a5f4eec819de28f205"
        },
        {
          "url": "https://git.kernel.org/stable/c/da03f5d1b2c319a2b74fe76edeadcd8fa5f44376"
        }
      ],
      "title": "bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44933",
    "datePublished": "2024-08-26T10:11:24.675Z",
    "dateReserved": "2024-08-21T05:34:56.664Z",
    "dateUpdated": "2026-08-05T11:37:06.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-44933",
      "date": "2026-08-05",
      "epss": "0.00187",
      "percentile": "0.08504"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"00FEED69-9465-4F0C-870C-DE98C3FFFD94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()\\n\\nA recent commit has modified the code in __bnxt_reserve_rings() to\\nset the default RSS indirection table to default only when the number\\nof RX rings is changing.  While this works for newer firmware that\\nrequires RX ring reservations, it causes the regression on older\\nfirmware not requiring RX ring resrvations (BNXT_NEW_RM() returns\\nfalse).\\n\\nWith older firmware, RX ring reservations are not required and so\\nhw_resc-\u003eresv_rx_rings is not always set to the proper value.  The\\ncomparison:\\n\\nif (old_rx_rings != bp-\u003ehw_resc.resv_rx_rings)\\n\\nin __bnxt_reserve_rings() may be false even when the RX rings are\\nchanging.  This will cause __bnxt_reserve_rings() to skip setting\\nthe default RSS indirection table to default to match the current\\nnumber of RX rings.  This may later cause bnxt_fill_hw_rss_tbl() to\\nuse an out-of-range index.\\n\\nWe already have bnxt_check_rss_tbl_no_rmgr() to handle exactly this\\nscenario.  We just need to move it up in bnxt_need_reserve_rings()\\nto be called unconditionally when using older firmware.  Without the\\nfix, if the TX rings are changing, we\u0027ll skip the\\nbnxt_check_rss_tbl_no_rmgr() call and __bnxt_reserve_rings() may also\\nskip the bnxt_set_dflt_rss_indir_tbl() call for the reason explained\\nin the last paragraph.  Without setting the default RSS indirection\\ntable to default, it causes the regression:\\n\\nBUG: KASAN: slab-out-of-bounds in __bnxt_hwrm_vnic_set_rss+0xb79/0xe40\\nRead of size 2 at addr ffff8881c5809618 by task ethtool/31525\\nCall Trace:\\n__bnxt_hwrm_vnic_set_rss+0xb79/0xe40\\n bnxt_hwrm_vnic_rss_cfg_p5+0xf7/0x460\\n __bnxt_setup_vnic_p5+0x12e/0x270\\n __bnxt_open_nic+0x2262/0x2f30\\n bnxt_open_nic+0x5d/0xf0\\n ethnl_set_channels+0x5d4/0xb30\\n ethnl_default_set_doit+0x2f1/0x620\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: bnxt_en: corrige la memoria fuera de los l\\u00edmites en bnxt_fill_hw_rss_tbl() Una confirmaci\\u00f3n reciente modific\\u00f3 el c\\u00f3digo en __bnxt_reserve_rings() para configurar la tabla de direccionamiento indirecto RSS predeterminada solo cuando el n\\u00famero de Los anillos RX est\\u00e1n cambiando. Si bien esto funciona para firmware m\\u00e1s nuevo que requiere reservas de anillo RX, provoca la regresi\\u00f3n en firmware m\\u00e1s antiguo que no requiere reservas de anillo RX (BNXT_NEW_RM() devuelve falso). Con firmware anterior, no se requieren reservas de anillo RX y, por lo tanto, hw_resc-\u0026gt;resv_rx_rings no siempre est\\u00e1 configurado en el valor adecuado. La comparaci\\u00f3n: if (old_rx_rings != bp-\u0026gt;hw_resc.resv_rx_rings) en __bnxt_reserve_rings() puede ser falso incluso cuando los anillos RX est\\u00e1n cambiando. Esto har\\u00e1 que __bnxt_reserve_rings() omita la configuraci\\u00f3n de la tabla de direccionamiento indirecto RSS predeterminada para que coincida con el n\\u00famero actual de anillos RX. Posteriormente, esto puede provocar que bnxt_fill_hw_rss_tbl() utilice un \\u00edndice fuera de rango. Ya tenemos bnxt_check_rss_tbl_no_rmgr() para manejar exactamente este escenario. Solo necesitamos moverlo hacia arriba en bnxt_need_reserve_rings() para que se llame incondicionalmente cuando usemos firmware anterior. Sin la soluci\\u00f3n, si los anillos TX est\\u00e1n cambiando, omitiremos la llamada a bnxt_check_rss_tbl_no_rmgr() y __bnxt_reserve_rings() tambi\\u00e9n puede omitir la llamada a bnxt_set_dflt_rss_indir_tbl() por el motivo explicado en el \\u00faltimo p\\u00e1rrafo. Sin configurar la tabla de direccionamiento indirecto RSS predeterminada, se produce la regresi\\u00f3n: ERROR: KASAN: slab-out-of-bounds in __bnxt_hwrm_vnic_set_rss+0xb79/0xe40 Lectura de tama\\u00f1o 2 en la direcci\\u00f3n ffff8881c5809618 mediante la tarea ethtool/31525 Call Trace: __bnxt_hwrm_vnic_set_rss+0 xb79 /0xe40 bnxt_hwrm_vnic_rss_cfg_p5+0xf7/0x460 __bnxt_setup_vnic_p5+0x12e/0x270 __bnxt_open_nic+0x2262/0x2f30 bnxt_open_nic+0x5d/0xf0 ethnl_set_channels+0x5d4/0 xb30 ethnl_default_set_doit+0x2f1/0x620\"}]",
      "id": "CVE-2024-44933",
      "lastModified": "2024-08-27T16:08:38.973",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-08-26T11:15:05.547",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/abd573e9ad2ba64eaa6418a5f4eec819de28f205\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/da03f5d1b2c319a2b74fe76edeadcd8fa5f44376\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-44933\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-26T11:15:05.547\",\"lastModified\":\"2026-08-04T11:20:00.387\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()\\n\\nA recent commit has modified the code in __bnxt_reserve_rings() to\\nset the default RSS indirection table to default only when the number\\nof RX rings is changing.  While this works for newer firmware that\\nrequires RX ring reservations, it causes the regression on older\\nfirmware not requiring RX ring resrvations (BNXT_NEW_RM() returns\\nfalse).\\n\\nWith older firmware, RX ring reservations are not required and so\\nhw_resc-\u003eresv_rx_rings is not always set to the proper value.  The\\ncomparison:\\n\\nif (old_rx_rings != bp-\u003ehw_resc.resv_rx_rings)\\n\\nin __bnxt_reserve_rings() may be false even when the RX rings are\\nchanging.  This will cause __bnxt_reserve_rings() to skip setting\\nthe default RSS indirection table to default to match the current\\nnumber of RX rings.  This may later cause bnxt_fill_hw_rss_tbl() to\\nuse an out-of-range index.\\n\\nWe already have bnxt_check_rss_tbl_no_rmgr() to handle exactly this\\nscenario.  We just need to move it up in bnxt_need_reserve_rings()\\nto be called unconditionally when using older firmware.  Without the\\nfix, if the TX rings are changing, we\u0027ll skip the\\nbnxt_check_rss_tbl_no_rmgr() call and __bnxt_reserve_rings() may also\\nskip the bnxt_set_dflt_rss_indir_tbl() call for the reason explained\\nin the last paragraph.  Without setting the default RSS indirection\\ntable to default, it causes the regression:\\n\\nBUG: KASAN: slab-out-of-bounds in __bnxt_hwrm_vnic_set_rss+0xb79/0xe40\\nRead of size 2 at addr ffff8881c5809618 by task ethtool/31525\\nCall Trace:\\n__bnxt_hwrm_vnic_set_rss+0xb79/0xe40\\n bnxt_hwrm_vnic_rss_cfg_p5+0xf7/0x460\\n __bnxt_setup_vnic_p5+0x12e/0x270\\n __bnxt_open_nic+0x2262/0x2f30\\n bnxt_open_nic+0x5d/0xf0\\n ethnl_set_channels+0x5d4/0xb30\\n ethnl_default_set_doit+0x2f1/0x620\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: bnxt_en: corrige la memoria fuera de los l\u00edmites en bnxt_fill_hw_rss_tbl() Una confirmaci\u00f3n reciente modific\u00f3 el c\u00f3digo en __bnxt_reserve_rings() para configurar la tabla de direccionamiento indirecto RSS predeterminada solo cuando el n\u00famero de Los anillos RX est\u00e1n cambiando. Si bien esto funciona para firmware m\u00e1s nuevo que requiere reservas de anillo RX, provoca la regresi\u00f3n en firmware m\u00e1s antiguo que no requiere reservas de anillo RX (BNXT_NEW_RM() devuelve falso). Con firmware anterior, no se requieren reservas de anillo RX y, por lo tanto, hw_resc-\u0026gt;resv_rx_rings no siempre est\u00e1 configurado en el valor adecuado. La comparaci\u00f3n: if (old_rx_rings != bp-\u0026gt;hw_resc.resv_rx_rings) en __bnxt_reserve_rings() puede ser falso incluso cuando los anillos RX est\u00e1n cambiando. Esto har\u00e1 que __bnxt_reserve_rings() omita la configuraci\u00f3n de la tabla de direccionamiento indirecto RSS predeterminada para que coincida con el n\u00famero actual de anillos RX. Posteriormente, esto puede provocar que bnxt_fill_hw_rss_tbl() utilice un \u00edndice fuera de rango. Ya tenemos bnxt_check_rss_tbl_no_rmgr() para manejar exactamente este escenario. Solo necesitamos moverlo hacia arriba en bnxt_need_reserve_rings() para que se llame incondicionalmente cuando usemos firmware anterior. Sin la soluci\u00f3n, si los anillos TX est\u00e1n cambiando, omitiremos la llamada a bnxt_check_rss_tbl_no_rmgr() y __bnxt_reserve_rings() tambi\u00e9n puede omitir la llamada a bnxt_set_dflt_rss_indir_tbl() por el motivo explicado en el \u00faltimo p\u00e1rrafo. Sin configurar la tabla de direccionamiento indirecto RSS predeterminada, se produce la regresi\u00f3n: ERROR: KASAN: slab-out-of-bounds in __bnxt_hwrm_vnic_set_rss+0xb79/0xe40 Lectura de tama\u00f1o 2 en la direcci\u00f3n ffff8881c5809618 mediante la tarea ethtool/31525 Call Trace: __bnxt_hwrm_vnic_set_rss+0 xb79 /0xe40 bnxt_hwrm_vnic_rss_cfg_p5+0xf7/0x460 __bnxt_setup_vnic_p5+0x12e/0x270 __bnxt_open_nic+0x2262/0x2f30 bnxt_open_nic+0x5d/0xf0 ethnl_set_channels+0x5d4/0 xb30 ethnl_default_set_doit+0x2f1/0x620\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bc57f879a420d19bb5ecdb480f858371554f2258\",\"lessThan\":\"abd573e9ad2ba64eaa6418a5f4eec819de28f205\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98ba1d931f611e8f8f519c0405fa0a1a76554bfa\",\"lessThan\":\"da03f5d1b2c319a2b74fe76edeadcd8fa5f44376\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10.4\",\"lessThan\":\"6.10.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:27:54.693041Z\",\"id\":\"CVE-2024-44933\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"00FEED69-9465-4F0C-870C-DE98C3FFFD94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/abd573e9ad2ba64eaa6418a5f4eec819de28f205\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da03f5d1b2c319a2b74fe76edeadcd8fa5f44376\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:18:18+00:00",
      "cve": "CVE-2024-44933",
      "id": "CVE-2024-44933",
      "initial_release_date": "2024-08-26T00:00:00+00:00",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "170",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-44933.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:53:41Z",
      "cve": "CVE-2024-44933",
      "id": "CVE-2024-44933",
      "initial_release_date": "2024-08-28T02:25:46Z",
      "product_status:known_not_affected": "310",
      "product_status:recommended": "59",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-44933",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-44933.json",
      "version": "18"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-44933\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:27:54.693041Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:12.323Z\"}}], \"cna\": {\"title\": \"bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"bc57f879a420d19bb5ecdb480f858371554f2258\", \"lessThan\": \"abd573e9ad2ba64eaa6418a5f4eec819de28f205\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98ba1d931f611e8f8f519c0405fa0a1a76554bfa\", \"lessThan\": \"da03f5d1b2c319a2b74fe76edeadcd8fa5f44376\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.10.4\", \"lessThan\": \"6.10.5\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/abd573e9ad2ba64eaa6418a5f4eec819de28f205\"}, {\"url\": \"https://git.kernel.org/stable/c/da03f5d1b2c319a2b74fe76edeadcd8fa5f44376\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()\\n\\nA recent commit has modified the code in __bnxt_reserve_rings() to\\nset the default RSS indirection table to default only when the number\\nof RX rings is changing.  While this works for newer firmware that\\nrequires RX ring reservations, it causes the regression on older\\nfirmware not requiring RX ring resrvations (BNXT_NEW_RM() returns\\nfalse).\\n\\nWith older firmware, RX ring reservations are not required and so\\nhw_resc-\u003eresv_rx_rings is not always set to the proper value.  The\\ncomparison:\\n\\nif (old_rx_rings != bp-\u003ehw_resc.resv_rx_rings)\\n\\nin __bnxt_reserve_rings() may be false even when the RX rings are\\nchanging.  This will cause __bnxt_reserve_rings() to skip setting\\nthe default RSS indirection table to default to match the current\\nnumber of RX rings.  This may later cause bnxt_fill_hw_rss_tbl() to\\nuse an out-of-range index.\\n\\nWe already have bnxt_check_rss_tbl_no_rmgr() to handle exactly this\\nscenario.  We just need to move it up in bnxt_need_reserve_rings()\\nto be called unconditionally when using older firmware.  Without the\\nfix, if the TX rings are changing, we\u0027ll skip the\\nbnxt_check_rss_tbl_no_rmgr() call and __bnxt_reserve_rings() may also\\nskip the bnxt_set_dflt_rss_indir_tbl() call for the reason explained\\nin the last paragraph.  Without setting the default RSS indirection\\ntable to default, it causes the regression:\\n\\nBUG: KASAN: slab-out-of-bounds in __bnxt_hwrm_vnic_set_rss+0xb79/0xe40\\nRead of size 2 at addr ffff8881c5809618 by task ethtool/31525\\nCall Trace:\\n__bnxt_hwrm_vnic_set_rss+0xb79/0xe40\\n bnxt_hwrm_vnic_rss_cfg_p5+0xf7/0x460\\n __bnxt_setup_vnic_p5+0x12e/0x270\\n __bnxt_open_nic+0x2262/0x2f30\\n bnxt_open_nic+0x5d/0xf0\\n ethnl_set_channels+0x5d4/0xb30\\n ethnl_default_set_doit+0x2f1/0x620\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.5\", \"versionStartIncluding\": \"6.10.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:32:16.863Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-44933\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:32:16.863Z\", \"dateReserved\": \"2024-08-21T05:34:56.664Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-26T10:11:24.675Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.