CVE-2021-47015

What it actually does

Incorrect RX consumer index passed to bnxt_discard_rx() in the error path of bnxt_rx_pkt() causes the driver to reference the wrong buffer descriptor, resulting in invalid memory access and a kernel page fault that panics the system.

Why it matters to the business

Systems using affected Broadcom NetXtreme-E network adapters experience unexpected kernel crashes and reboots under normal or error-path RX traffic conditions, leading to unplanned downtime and loss of network connectivity until manual intervention or automatic recovery.

How an attack unfolds

An attacker triggers RX buffer completion out-of-order (via crafted packets or hardware conditions that expose the underlying hardware bug) so the driver enters the error path; the wrong raw_cons index is supplied, causing a subsequent access to an invalid descriptor and a fatal page fault that crashes the kernel.

How to fix it

Update to a Linux kernel version that contains commit fixing the RX consumer index logic in bnxt_en (post-2021-47015 backports). Reboot after installation and verify the bnxt_en module version no longer contains the flawed bnxt_rx_pkt error-path code.

How to confirm the fix worked

Confirm the running kernel contains the upstream fix by checking the bnxt_en source or module symbols for the corrected tmp_raw_cons usage; test with traffic patterns that previously exercised the out-of-order RX error path and verify no crash occurs.

Typical attack path

1. Send or induce network traffic that forces the RX ring into an out-of-order completion state
2. Driver detects the anomaly and calls bnxt_discard_rx() with the stale raw_cons index
3. Subsequent RX processing dereferences an invalid address, triggering a page fault
4. Kernel oops handler terminates the process and panics the system

How to detect it

Search kernel logs and crash dumps for stack traces containing bnxt_rx_pkt+237, __bad_area_nosemaphore, and page_fault originating from the bnxt_en driver; correlate with RX ring reset events logged by bnxt_en.

What your security team should do

• Prioritize kernel updates on all systems exposing bnxt_en interfaces to production networks
• Monitor kernel logs for bnxt_rx_pkt page-fault oops signatures until patches are applied
• If immediate reboot is not feasible, isolate affected hosts from untrusted traffic to reduce trigger probability