CVE-2024-44933

What it actually does

Out-of-bounds slab read in bnxt_fill_hw_rss_tbl and __bnxt_hwrm_vnic_set_rss when the default RSS indirection table is not reset after a ring count change on older firmware that does not require RX ring reservations, allowing an index derived from an unset resv_rx_rings value to exceed the allocated table bounds.

Why it matters to the business

Unprivileged local users or automated configuration tools can trigger kernel crashes or memory corruption on systems using Broadcom NetXtreme-E NICs with older firmware, leading to denial of service, potential privilege escalation, and unplanned downtime during routine ethtool or network interface changes.

How an attack unfolds

An attacker with local access invokes ethtool to alter the number of TX or RX rings on a bnxt_en interface; because older firmware skips the RSS table reset path, bnxt_fill_hw_rss_tbl later indexes beyond the allocated table, producing a KASAN-detected out-of-bounds read that can be turned into controlled memory corruption or a crash.

How to fix it

Upgrade the Linux kernel to 6.10.5 or later, or apply the stable backport commit abd573e9ad2ba64eaa6418a5f4eec819de28f205; ensure bnxt_check_rss_tbl_no_rmgr is invoked unconditionally for non-RM firmware; reboot after installation and verify the driver version.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or is at least 6.10.5; exercise ethtool ring changes on affected hardware and verify absence of KASAN reports or slab-out-of-bounds warnings in dmesg; check that bnxt_need_reserve_rings always calls the RSS table check on older firmware.

Typical attack path

1. Obtain local shell or execute code on a host with a vulnerable bnxt_en device and older firmware
2. Call ethtool --set-channels or equivalent to change ring counts
3. Trigger bnxt_open_nic path that calls __bnxt_reserve_rings without updating the RSS indirection table
4. Cause __bnxt_hwrm_vnic_set_rss to dereference an out-of-range index and read past the slab allocation

How to detect it

Search kernel logs and dmesg for "KASAN: slab-out-of-bounds" combined with bnxt_fill_hw_rss_tbl or __bnxt_hwrm_vnic_set_rss stack traces; inspect audit logs for ethtool channel modifications immediately preceding crashes on bnxt_en interfaces.

What your security team should do

• Prioritize patching production systems using Broadcom bnxt_en NICs within the next maintenance window
• Restrict unprivileged ethtool access via capabilities or policy until patches are applied
• Monitor kernel logs for bnxt-related KASAN or slab-out-of-bounds messages after changes
• Test the updated kernel on representative hardware before broad deployment