CVE-2024-56656: bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
In the Linux kernel, the following vulnerability has been resolved:
bnxten: Fix aggregation ID mask to prevent oops on 5760X chips
The 5760X (P7) chip's HW GRO/LRO interface is very similar to that of the previous generation (5750X or P5). However, the aggregation ID fields in the completion structures on P7 have been redefined from 16 bits to 12 bits. The freed up 4 bits are redefined for part of the metadata such as the VLAN ID. The aggregation ID mask was not modified when adding support for P7 chips. Including the extra 4 bits for the aggregation ID can potentially cause the driver to store or fetch the packet header of GRO/LRO packets in the wrong TPA buffer. It may hit the BUG() condition in skbpull() because the SKB contains no valid packet header:
kernel BUG at include/linux/skbuff.h:2766! Oops: invalid opcode: 0000 1 PREEMPT SMP NOPTI CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Kdump: loaded Tainted: G OE 6.12.0-rc2+ #7 Tainted: [O]=OOTMODULE, [E]=UNSIGNEDMODULE Hardware name: Dell Inc. PowerEdge R760/0VRV9X, BIOS 1.0.1 12/27/2022 RIP: 0010:ethtypetrans+0xda/0x140 Code: 80 00 00 00 eb c1 8b 47 70 2b 47 74 48 8b 97 d0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb a5 <0f> 0b b8 00 01 00 00 eb 9c 48 85 ff 74 eb 31 f6 b9 02 00 00 00 48 RSP: 0018:ff615003803fcc28 EFLAGS: 00010283 RAX: 00000000000022d2 RBX: 0000000000000003 RCX: ff2e8c25da334040 RDX: 0000000000000040 RSI: ff2e8c25c1ce8000 RDI: ff2e8c25869f9000 RBP: ff2e8c258c31c000 R08: ff2e8c25da334000 R09: 0000000000000001 R10: ff2e8c25da3342c0 R11: ff2e8c25c1ce89c0 R12: ff2e8c258e0990b0 R13: ff2e8c25bb120000 R14: ff2e8c25c1ce89c0 R15: ff2e8c25869f9000 FS: 0000000000000000(0000) GS:ff2e8c34be300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f05317e4c8 CR3: 000000108bac6006 CR4: 0000000000773ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> ? die+0x33/0x90 ? dotrap+0xd9/0x100 ? ethtypetrans+0xda/0x140 ? doerrortrap+0x65/0x80 ? ethtypetrans+0xda/0x140 ? excinvalidop+0x4e/0x70 ? ethtypetrans+0xda/0x140 ? asmexcinvalidop+0x16/0x20 ? ethtypetrans+0xda/0x140 bnxttpaend+0x10b/0x6b0 [bnxten] ? bnxttpastart+0x195/0x320 [bnxten] bnxtrxpkt+0x902/0xd90 [bnxten] ? bnxttxint.constprop.0+0x89/0x300 [bnxten] ? kmemcachefree+0x343/0x440 ? bnxttxint.constprop.0+0x24f/0x300 [bnxten] bnxtpollwork+0x193/0x370 [bnxten] bnxtpollp5+0x9a/0x300 [bnxten] ? trytowakeup+0x209/0x670 napipoll+0x29/0x1b0
Fix it by redefining the aggregation ID mask for P5PLUS chips to be 12 bits. This will work because the maximum aggregation ID is less than 4096 on all P5PLUS chips.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Configuration
Fix aggregation ID handling by redefining the aggregation ID mask for P5_PLUS chips to be 12 bits to prevent the driver from storing/fetching GRO/LRO packet header data in the wrong TPA buffer on 5760X (P7) systems.
Linux kernel bnxt_en driver (bnxt_en) aggregation ID handling aggregation ID mask for P5_PLUS chips = 12 bits
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56656?
CVE-2024-56656 is considered a moderate severity vulnerability due to its impact on the Linux kernel's functionality.
How do I fix CVE-2024-56656?
To fix CVE-2024-56656, you should update your Linux kernel to a version greater than 6.12.6 or apply the relevant patches provided by the Linux kernel maintainers.
What versions of the Linux kernel are affected by CVE-2024-56656?
CVE-2024-56656 affects Linux kernel versions ranging from 6.8 up to and including 6.12.6 and the 6.13 release candidates.
Why is CVE-2024-56656 a concern for users of the Linux kernel?
CVE-2024-56656 is a concern because it can cause system instability and potential crashes, especially on systems utilizing the 5760X hardware chip.
Is there a known exploit for CVE-2024-56656?
As of now, there are no publicly known exploits specifically targeting CVE-2024-56656.