CVE-2024-44933— bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在bnxt_fill_hw_rss_tbl函数中存在内存越界问题。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-44933
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()
A recent commit has modified the code in __bnxt_reserve_rings() to
set the default RSS indirection table to default only when the number
of RX rings is changing. While this works for newer firmware that
requires RX ring reservations, it causes the regression on older
firmware not requiring RX ring resrvations (BNXT_NEW_RM() returns
false).
With older firmware, RX ring reservations are not required and so
hw_resc->resv_rx_rings is not always set to the proper value. The
comparison:
if (old_rx_rings != bp->hw_resc.resv_rx_rings)
in __bnxt_reserve_rings() may be false even when the RX rings are
changing. This will cause __bnxt_reserve_rings() to skip setting
the default RSS indirection table to default to match the current
number of RX rings. This may later cause bnxt_fill_hw_rss_tbl() to
use an out-of-range index.
We already have bnxt_check_rss_tbl_no_rmgr() to handle exactly this
scenario. We just need to move it up in bnxt_need_reserve_rings()
to be called unconditionally when using older firmware. Without the
fix, if the TX rings are changing, we'll skip the
bnxt_check_rss_tbl_no_rmgr() call and __bnxt_reserve_rings() may also
skip the bnxt_set_dflt_rss_indir_tbl() call for the reason explained
in the last paragraph. Without setting the default RSS indirection
table to default, it causes the regression:
BUG: KASAN: slab-out-of-bounds in __bnxt_hwrm_vnic_set_rss+0xb79/0xe40
Read of size 2 at addr ffff8881c5809618 by task ethtool/31525
Call Trace:
__bnxt_hwrm_vnic_set_rss+0xb79/0xe40
bnxt_hwrm_vnic_rss_cfg_p5+0xf7/0x460
__bnxt_setup_vnic_p5+0x12e/0x270
__bnxt_open_nic+0x2262/0x2f30
bnxt_open_nic+0x5d/0xf0
ethnl_set_channels+0x5d4/0xb30
ethnl_default_set_doit+0x2f1/0x620
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在bnxt_fill_hw_rss_tbl函数中存在内存越界问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-44933
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-44933
请登录查看更多情报信息。
Other References for CVE-2024-44933 (2)
Same Patch Batch · Linux · 2024-08-26 · 39 CVEs total
| CVE-2024-44942 | 7.8 HIGH | f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC |
| CVE-2024-43910 | 7.8 HIGH | bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses |
| CVE-2024-44934 | 7.8 HIGH | net: bridge: mcast: wait for previous gc cycles when removing port |
| CVE-2024-43897 | 7.8 HIGH | net: drop bad gso csum_start and offset in virtio_net_hdr |
| CVE-2024-43892 | 7.8 HIGH | memcg: protect concurrent access to mem_cgroup_idr |
| CVE-2024-43891 | 7.8 HIGH | tracing: Have format file honor EVENT_FILE_FL_FREED |
| CVE-2024-44939 | 7.8 HIGH | jfs: fix null ptr deref in dtInsertEntry |
| CVE-2024-43888 | 7.8 HIGH | mm: list_lru: fix UAF for memory cgroup |
| CVE-2024-44941 | 7.8 HIGH | f2fs: fix to cover read extent cache access with lock |
| CVE-2024-44940 | 7.5 HIGH | fou: remove warn in gue_gro_receive on unsupported protocol |
| CVE-2024-43913 | 7.0 HIGH | nvme: apple: fix device reference counting |
| CVE-2024-44938 | jfs: Fix shift-out-of-bounds in dbDiscardAG | |
| CVE-2024-44937 | platform/x86: intel-vbtn: Protect ACPI notify handler against recursion | |
| CVE-2024-44936 | power: supply: rt5033: Bring back i2c_set_clientdata | |
| CVE-2024-44935 | sctp: Fix null-ptr-deref in reuseport_add_sock(). | |
| CVE-2024-44932 | idpf: fix UAFs when destroying the queues | |
| CVE-2024-44931 | gpio: prevent potential speculation leaks in gpio_device_get_desc() | |
| CVE-2024-43914 | md/raid5: avoid BUG_ON() while continue reshape after reassembling | |
| CVE-2024-43912 | wifi: nl80211: disallow setting special AP channel widths | |
| CVE-2024-43911 | wifi: mac80211: fix NULL dereference at band check in starting tx ba session |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
Same vendor: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
V. Comments for CVE-2024-44933
No comments yet