Описание
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix max SGEs for the Work Request Gen P7 supports up to 13 SGEs for now. WQE software structure can hold only 6 now. Since the max send sge is reported as 13, the stack can give requests up to 13 SGEs. This is causing traffic failures and system crashes. Use the define for max SGE supported for variable size. This will work for both static and variable WQEs.
Отчет
A low-severity denial of service vulnerability was found in the Linux kernel's RDMA driver for Broadcom NetXtreme-E adapters (bnxt_re). On Gen P7 hardware, the driver reported a maximum of 13 scatter-gather entries (SGEs) per Work Request while its Work Queue Entry (WQE) software structure could only accommodate 6. As a result, RDMA work requests containing more than 6 SGEs could cause traffic failures and system crashes. The flaw affects system availability only; there is no impact on confidentiality or integrity, and exploiting it requires the ability to submit RDMA work requests locally on the affected hardware. Red Hat Enterprise Linux 9.6 is affected in the kernel and kernel-rt components, and a fix is being pursued for these streams. Red Hat Enterprise Linux 6, 8, and 10 releases and Red Hat's Hosted OpenShift offerings are not affected; for Red Hat Enterprise Linux 10 the vulnerable code is not present. Red Hat Enterprise Linux 7 is out of support scope. Red Hat Product Security rates this issue as low severity (CVSS 3.1 score 4.4, AV:L/AC:L/PR:H) based on the local attack vector, high privileges required, and availability-only impact. This differs significantly from the critical score published in the CVE record, which does not reflect the technical nature of this device driver bug.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
4.4 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix max SGEs for the Work Request Gen P7 supports up to 13 SGEs for now. WQE software structure can hold only 6 now. Since the max send sge is reported as 13, the stack can give requests up to 13 SGEs. This is causing traffic failures and system crashes. Use the define for max SGE supported for variable size. This will work for both static and variable WQEs.
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix max SGEs for the Work Request Gen P7 supports up to 13 SGEs for now. WQE software structure can hold only 6 now. Since the max send sge is reported as 13, the stack can give requests up to 13 SGEs. This is causing traffic failures and system crashes. Use the define for max SGE supported for variable size. This will work for both static and variable WQEs.
In the Linux kernel, the following vulnerability has been resolved: R ...
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix max SGEs for the Work Request Gen P7 supports up to 13 SGEs for now. WQE software structure can hold only 6 now. Since the max send sge is reported as 13, the stack can give requests up to 13 SGEs. This is causing traffic failures and system crashes. Use the define for max SGE supported for variable size. This will work for both static and variable WQEs.
Уязвимость описания структуры bnxt_qplib_swqe в модуле drivers/infiniband/hw/bnxt_re/qplib_fp.h ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании.
EPSS
4.4 Medium
CVSS3