CVE-2024-50158

A flaw was found in the Linux kernel's Broadcom NetXtreme-E Remote Direct Memory Access (RDMA) driver (bnxt_re). When querying hardware statistics, improper bounds checking while parsing pacing statistics allows an out-of-bounds memory write. A local attacker could exploit this vulnerability to cause a Denial of Service (DoS) via a system crash or memory corruption.

A moderate-impact flaw was found in the Linux kernel's Broadcom NetXtreme-E Remote Direct Memory Access (RDMA) driver (bnxt_re) as shipped in Red Hat Enterprise Linux 9 and Fedora. The driver exports pacing statistics only on GenP5 and P7 adapters, but while parsing those statistics the driver applies an improper bounds check based on rdev->dbr_pacing, so querying hardware statistics can trigger an out-of-bounds write past the allocated statistics buffer (observed by KASAN as a slab-out-of-bounds 8-byte write in bnxt_re_get_hw_stats). A local attacker with the privileges needed to query RDMA hardware statistics on a system using a Broadcom NetXtreme-E adapter could exploit this flaw to crash the system or corrupt kernel memory, resulting in a denial of service. Within Red Hat Enterprise Linux 9, the kernel and kernel-rt components are affected: a fix is being pursued for the rhel-9.6 stream, while the rhel-9.5.z stream was closed as Won't Do. The Fedora kernel is also affected. The kernel and kernel-rt packages in Red Hat Enterprise Linux 6, the in-support Red Hat Enterprise Linux 8 z-streams, and the Hosted OpenShift (ARO and OSD) environments are not affected, and Red Hat Enterprise Linux 7 is out of support scope. Red Hat rates this flaw Moderate severity (CVSS 6.7) rather than the Important severity assigned upstream and by NIST (7.8), because exploitation requires high privileges and an attacker cannot control the nature or location of the out-of-bounds write.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.