Описание
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()
bnxt_alloc_one_tpa_info_data() returns -ENOMEM as soon as one allocation
fails. This leaves the remaining rxr->rx_tpa[] entries zeroed.
bnxt_queue_mem_alloc() discards that return value, so the partially
initialized ring is installed by bnxt_queue_start().
Since the agg_id is picked by the hardware and bnxt_alloc_agg_idx maps
it to a SW index in rxr->rx_tpa[], it is possible that an uninitialized
slot can be chosen which would hand a zero DMA address to the device.
Fix this by checking the return value of bnxt_alloc_one_tpa_info_data
and unwinding, freeing the ring buffers.
A flaw was found in the Linux kernel's Broadcom NetXtreme-E (bnxt_en) network driver. The driver does not properly handle memory allocation failures when configuring Transparent Packet Aggregation (TPA) buffers, leaving partially initialized ring buffers active. When memory allocation fails, an uninitialized descriptor with an invalid Direct Memory Access (DMA) address can be passed to the network device, which may trigger a system crash and lead to a Denial of Service (DoS).
Отчет
A flaw was found in the Linux kernel's Broadcom NetXtreme-E (bnxt_en) network driver, rated Moderate by Red Hat Product Security. bnxt_queue_mem_alloc() ignores the error return of bnxt_alloc_one_tpa_info_data(), so when a Transparent Packet Aggregation (TPA) buffer allocation fails with -ENOMEM, a partially initialized receive ring is still installed by bnxt_queue_start(). Because the hardware-selected aggregation ID can map to an uninitialized rx_tpa[] entry, a zero DMA address may be handed to the device, which can trigger DMA errors, device failure, or a kernel crash, resulting in denial of service. Exploiting this requires local access with privileges to (re)configure the network interface on a system equipped with affected Broadcom NetXtreme-E hardware, and it also depends on inducing a memory allocation failure, which limits practical exploitability. The vulnerable code is present in Red Hat Enterprise Linux 9 (rhel-9.8.z, rhel-9.9, rhel-9.10) and Red Hat Enterprise Linux 10 (rhel-10.2.z, rhel-10.3, rhel-10.4) kernels, in Red Hat In-Vehicle OS 2, and in OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 (RHEL CoreOS 9 based). Fixes for these streams are currently deferred because the flaw can only be triggered under memory allocation failure conditions by a privileged local user, and the residual risk is limited to denial of service on hosts using the affected bnxt_en hardware. Red Hat Enterprise Linux 6, 7, and 8, the earlier RHEL 9 and RHEL 10 minor streams, and OpenShift Container Platform 4.12 through 4.21 are not affected because the vulnerable code is not present. Red Hat assigned a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting the local attack vector with no impact on confidentiality or integrity.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() bnxt_alloc_one_tpa_info_data() returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr->rx_tpa[] entries zeroed. bnxt_queue_mem_alloc() discards that return value, so the partially initialized ring is installed by bnxt_queue_start(). Since the agg_id is picked by the hardware and bnxt_alloc_agg_idx maps it to a SW index in rxr->rx_tpa[], it is possible that an uninitialized slot can be chosen which would hand a zero DMA address to the device. Fix this by checking the return value of bnxt_alloc_one_tpa_info_data and unwinding, freeing the ring buffers.
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() bnxt_alloc_one_tpa_info_data() returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr->rx_tpa[] entries zeroed. bnxt_queue_mem_alloc() discards that return value, so the partially initialized ring is installed by bnxt_queue_start(). Since the agg_id is picked by the hardware and bnxt_alloc_agg_idx maps it to a SW index in rxr->rx_tpa[], it is possible that an uninitialized slot can be chosen which would hand a zero DMA address to the device. Fix this by checking the return value of bnxt_alloc_one_tpa_info_data and unwinding, freeing the ring buffers.
bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()
In the Linux kernel, the following vulnerability has been resolved: b ...
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() bnxt_alloc_one_tpa_info_data() returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr->rx_tpa[] entries zeroed. bnxt_queue_mem_alloc() discards that return value, so the partially initialized ring is installed by bnxt_queue_start(). Since the agg_id is picked by the hardware and bnxt_alloc_agg_idx maps it to a SW index in rxr->rx_tpa[], it is possible that an uninitialized slot can be chosen which would hand a zero DMA address to the device. Fix this by checking the return value of bnxt_alloc_one_tpa_info_data and unwinding, freeing the ring buffers.
5.5 Medium
CVSS3