CVE-2024-57973

In the Linux kernel, the following vulnerability has been resolved:

rdma/cxgb4: Prevent potential integer overflow on 32bit

The "gl->tot_len" variable is controlled by the user. It comes from process_responses(). On 32bit systems, the "gl->tot_len + sizeof(struct cpl_pass_accept_req) + sizeof(struct rss_header)" addition could have an integer wrapping bug. Use size_add() to prevent this.

A low-impact integer overflow flaw was found in the Linux kernel's Chelsio cxgb4 RDMA driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10. On 32-bit systems, adding the user-controlled gl->tot_len value (set in process_responses()) to the sizes of the cpl_pass_accept_req and rss_header structures could wrap, producing an incorrect size calculation. Red Hat rates this flaw as LOW impact (CVSS 4.4, local attack vector, high privileges required, availability impact only), which differs significantly from the upstream CVEORG score of 8.1 because the wrapping condition only arises on 32-bit systems using the cxgb4 RDMA driver for Chelsio adapters and requires privileged local access. Given the low severity, the fix for Red Hat Enterprise Linux 9 and 10 has been deferred to a future update; the residual risk is limited to a potential availability impact on 32-bit systems using the affected driver. Red Hat Enterprise Linux 6, 7, and 8 are out of support scope for this flaw, and Red Hat In-Vehicle OS 1.0 and 1.1 are not affected because the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.