CVE-2024-46833

What it actually does

The flaw allows an out-of-bounds array access in the hns3 SSU register query path when hardware-supplied tnl_num exceeds the fixed array length.

Why it matters to the business

Unpatched systems using affected hns3 network hardware risk kernel instability or memory corruption that can interrupt network services and require emergency restarts.

How an attack unfolds

An attacker with the ability to influence or emulate the hns3 hardware response supplies a tnl_num larger than the array size during register-info queries, causing the kernel to read or write past the array bounds.

How to fix it

Update the Linux kernel to commit c33a9806dc806bcb4a31dc71fb06979219181ad4 or later; apply the equivalent fix present in stable branches that contain this commit.

How to confirm the fix worked

Verify the running kernel contains commit c33a9806dc806bcb4a31dc71fb06979219181ad4, confirm the loop bound check against array length is present in the hns3 SSU query code, and test register queries on affected hardware.

Typical attack path

1. Obtain local or adjacent network access to a system with an hns3 NIC
2. Trigger or manipulate the SSU register-info query path
3. Supply an oversized tnl_num value from hardware
4. Cause out-of-bounds memory access leading to crash or corruption

How to detect it

Review kernel logs for hns3 driver oops or panic messages referencing array access during SSU register queries; no public exploit artifacts are known.

What your security team should do

• Prioritize patching kernel packages on all systems that use hns3 adapters
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict untrusted local access on systems with hns3 hardware until updated