CVE-2024-53209

A flaw was found in the Linux kernel's Broadcom NetXtreme-E (bnxt_en) network driver. This flaw can lead to a Denial of Service (DoS) through memory corruption when the Maximum Transmission Unit (MTU) is modified while eXpress Data Path (XDP) is active. The configuration change desynchronizes receive ring settings, causing network hardware to write data beyond allocated buffer boundaries via Direct Memory Access (DMA). A local user with network administration privileges can exploit this vulnerability to crash the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the bnxt_en kernel driver from loading if Broadcom NetXtreme network hardware is not required:

1. Add a modprobe configuration to blacklist the module:

echo "install bnxt_en /bin/true" > /etc/modprobe.d/disable-bnxt_en.conf

2. Unload the module if it is currently loaded and not in active use:

rmmod bnxt_en

Warning: Unloading active network drivers or modifying kernel module configurations can interrupt network connectivity and may require a system restart to take effect completely.

Caveats: Disabling this module disables support for Broadcom NetXtreme network interfaces. For systems actively using this hardware, this issue can be operationally avoided by refraining from changing interface MTU configurations while multi-buffer XDP programs are running.