CVE-2024-50172

What it actually does

The vulnerability is a memory leak in bnxt_re_setup_chip_ctx() where failure of bnxt_qplib_map_db_bar() leaves the memory allocated for rdev->chip_ctx unfreed.

Why it matters to the business

RDMA-enabled systems using affected Broadcom hardware may experience gradual memory exhaustion over repeated driver initialization failures, increasing operational risk in data-center or high-performance networking environments; low EPSS and no KEV status indicate limited immediate urgency.

How an attack unfolds

An attacker with local or RDMA access triggers repeated failures in bnxt_qplib_map_db_bar() during chip context setup, causing the driver to allocate but never release chip_ctx memory; listed threat actors reference generic Linux kernel resource and bounds issues but no public exploitation of this specific leak is recorded.

How to fix it

Apply the upstream kernel fix that frees chip_ctx on bnxt_qplib_map_db_bar() failure; no fixed version listed for the erroneous Firefox entries—use mainline or distribution kernel containing the resolution of CVE-2024-50172.

How to confirm the fix worked

Confirm the patch is present by inspecting bnxt_re_setup_chip_ctx() for the added kfree of chip_ctx on map failure path; verify no memory growth under repeated failure injection tests.

Typical attack path

1. Locate host with bnxt_re RDMA driver and Broadcom hardware
2. Induce map_db_bar() failure condition (e.g., via resource pressure or malformed setup)
3. Repeat initialization attempts to accumulate unfreed allocations
4. Monitor for memory pressure or OOM conditions

How to detect it

Inspect kernel logs for bnxt_re initialization failures around bnxt_qplib_map_db_bar; correlate with rising memory usage in slab or driver-specific allocations; no ransomware or KEV indicators reported.

What your security team should do

• Prioritize kernel updates on systems exposing RDMA/bnxt_re interfaces
• Monitor memory usage on affected hosts until patched
• Review RDMA driver usage and disable if not required