CVE-2024-50157: RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxtre: Avoid CPU lockups due fifo occupancy check loop
Driver waits indefinitely for the fifo occupancy to go below a threshold as soon as the pacing interrupt is received. This can cause soft lockup on one of the processors, if the rate of DB is very high.
Add a loop count for FPGA and exit the waitforfifooccupancybelowth if the loop is taking more time. Pacing will be continuing until the occupancy is below the threshold. This is ensured by the checks in bnxtrepacingtimerexp and further scheduling the work for pacing based on the fifo occupancy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.76.1-1 - Compensating control
In bnxt_re_pacing_timer_exp (RDMA/bnxt_re), add a loop count to the fifo-occupancy polling and exit __wait_for_fifo_occupancy_below_th if the loop takes more time, since the driver otherwise waits indefinitely for fifo occupancy to drop below the threshold after the pacing interrupt.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50157?
CVE-2024-50157 is considered a medium severity vulnerability due to the risk of causing soft lockups in systems using affected kernel versions.
How do I fix CVE-2024-50157?
To mitigate CVE-2024-50157, users should update their Linux kernel to version 6.12-rc4 or later, where the vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2024-50157?
CVE-2024-50157 affects Linux kernel versions from 6.6 to 6.11.6 and includes specific 6.12 release candidates up to rc3.
What are the potential impacts of CVE-2024-50157?
The potential impact of CVE-2024-50157 includes system instability and performance issues, specifically soft lockups during FIFO occupancy checks.
Is CVE-2024-50157 specific to any Linux distributions?
CVE-2024-50157 is related to the Linux kernel itself and could potentially affect any Linux distribution utilizing the vulnerable kernel versions.