CVE-2024-50158

What it actually does

Out-of-bounds write of size 8 in bnxt_re_get_hw_stats due to incorrect check on rdev->dbr_pacing when parsing pacing stats on GenP5/P7 adapters, triggering KASAN slab-out-of-bounds.

Why it matters to the business

Kernel memory corruption on systems using bnxt_re RDMA driver can cause crashes, instability, or potential privilege escalation; low EPSS indicates limited in-the-wild risk but still requires prompt patching given Linux kernel prevalence.

How an attack unfolds

An attacker with local access loads the bnxt_re module and triggers hardware stats collection path on affected adapters; the flawed bounds check leads to write beyond slab allocation, observed under KASAN. No specific threat actors or ransomware campaigns tied to this CVE.

How to fix it

Apply kernel updates containing the fix for RDMA/bnxt_re pacing stats check. For listed packages upgrade firefox (Ubuntu:14.04:LTS) to 42.0+build2-0ubuntu0.14.04.1 and thunderbird (Ubuntu:14.04:LTS) to 1:38.4.0+build3-0ubuntu0.14.04.1.

How to confirm the fix worked

Confirm updated kernel module no longer triggers KASAN report on bnxt_re_get_hw_stats; verify driver version and test stats export only on supported GenP5/P7 adapters.

Typical attack path

1. Obtain local access to target system with bnxt_re driver loaded
2. Trigger bnxt_re_get_hw_stats via modprobe or stats query
3. Exploit missing dbr_pacing validation to perform out-of-bounds write
4. Achieve memory corruption for denial-of-service or escalation

How to detect it

Review kernel logs for KASAN slab-out-of-bounds messages referencing bnxt_re_get_hw_stats; inspect module load events and hardware stats queries around crash timestamps.

• BUG: KASAN: slab-out-of-bounds in bnxt_re_get_hw_stats
• Write of size 8 at addr .* by task modprobe

What your security team should do

• Prioritize kernel updates on systems exposing RDMA/bnxt_re
• Monitor for local privilege escalation attempts involving bnxt_re module
• Disable unnecessary RDMA drivers where feasible until patched