CVE-2024-53209: bnxt_en: Fix receive ring space parameters when XDP is active
In the Linux kernel, the following vulnerability has been resolved:
bnxten: Fix receive ring space parameters when XDP is active
The MTU setting at the time an XDP multi-buffer is attached determines whether the aggregation ring will be used and the rxskbfunc handler. This is done in bnxtsetrxskbmode().
If the MTU is later changed, the aggregation ring setting may need to be changed and it may become out-of-sync with the settings initially done in bnxtsetrxskbmode(). This may result in random memory corruption and crashes as the HW may DMA data larger than the allocated buffer size, such as:
BUG: kernel NULL pointer dereference, address: 00000000000003c0 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 17 PID: 0 Comm: swapper/17 Kdump: loaded Tainted: G S OE 6.1.0-226bf9805506 #1 Hardware name: Wiwynn Delta Lake PVT BZA.02601.0150/Delta Lake-Class1, BIOS F0E3A12 08/26/2021 RIP: 0010:bnxtrxpkt+0xe97/0x1ae0 [bnxten] Code: 8b 95 70 ff ff ff 4c 8b 9d 48 ff ff ff 66 41 89 87 b4 00 00 00 e9 0b f7 ff ff 0f b7 43 0a 49 8b 95 a8 04 00 00 25 ff 0f 00 00 <0f> b7 14 42 48 c1 e2 06 49 03 95 a0 04 00 00 0f b6 42 33f RSP: 0018:ffffa19f40cc0d18 EFLAGS: 00010202 RAX: 00000000000001e0 RBX: ffff8e2c805c6100 RCX: 00000000000007ff RDX: 0000000000000000 RSI: ffff8e2c271ab990 RDI: ffff8e2c84f12380 RBP: ffffa19f40cc0e48 R08: 000000000001000d R09: 974ea2fcddfa4cbf R10: 0000000000000000 R11: ffffa19f40cc0ff8 R12: ffff8e2c94b58980 R13: ffff8e2c952d6600 R14: 0000000000000016 R15: ffff8e2c271ab990 FS: 0000000000000000(0000) GS:ffff8e3b3f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000003c0 CR3: 0000000e8580a004 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> bnxtpollwork+0x1c2/0x3e0 [bnxten]
To address the issue, we now call bnxtsetrxskbmode() within bnxtchangemtu() to properly set the AGG rings configuration and update rxskbfunc based on the new MTU value. Additionally, BNXTFLAGNOAGGRINGS is cleared at the beginning of bnxtsetrxskbmode() to make sure it gets set or cleared based on the current MTU.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Configuration
Modify the bnxt_en driver so that bnxt_set_rx_skb_mode() is called from bnxt_change_mtu() to keep the AGG rings configuration and rx_skb_func in sync with the new MTU when XDP multi-buffer is active.
bnxt_en (BNXT Ethernet driver) aggregation ring / rx_skb_func mode (bnxt_set_rx_skb_mode invoked during MTU changes) = Invoke bnxt_set_rx_skb_mode() within bnxt_change_mtu() and bnxt_change_mtu should properly set/clear AGG rings configuration and update rx_skb_func based on the current MTU - Configuration
Ensure BNXT_FLAG_NO_AGG_RINGS is cleared at the beginning of bnxt_set_rx_skb_mode() so the aggregation ring usage is determined correctly based on the current MTU when XDP multi-buffer is attached.
bnxt_en (BNXT Ethernet driver) BNXT_FLAG_NO_AGG_RINGS = Cleared at the beginning of bnxt_set_rx_skb_mode() (so it is set/cleared based on current MTU)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53209?
The severity of CVE-2024-53209 has not been explicitly rated, but it relates to a vulnerability in the Linux kernel that could impact system performance.
How do I fix CVE-2024-53209?
To fix CVE-2024-53209, upgrade to the patched versions of the Linux Kernel, specifically version 5.10.223-1, 5.10.226-1, 6.12.12-1, or 6.12.15-1.
Which Linux Kernel versions are affected by CVE-2024-53209?
CVE-2024-53209 affects multiple versions of the Linux Kernel, including versions prior to 5.10.223-1 and 6.12.12-1.
What components are involved in CVE-2024-53209?
CVE-2024-53209 involves the bnxt_en driver and the XDP (Express Data Path) feature in the Linux kernel.
Is there any exploit available for CVE-2024-53209?
Currently, there is no public information indicating the existence of active exploits for CVE-2024-53209.