CVE-2024-53161

What it actually does

Potential integer overflow when constructing the 64-bit SMC argument for the get DIMM info call; a 32-bit mem_ctrl_idx is left-shifted 16 bits and OR-ed with the DIMM index, truncating the upper 16 bits of the index value.

Why it matters to the business

Incorrect or lost DIMM information can impair memory error detection and correction on affected BlueField systems, reducing reliability of hardware health monitoring and increasing risk of undetected memory faults in production environments.

How an attack unfolds

An attacker with local access or the ability to trigger the EDAC BlueField SMC path supplies a mem_ctrl_idx value large enough that its upper 16 bits are lost during the 32-bit shift, causing the kernel to operate on a truncated argument and potentially return or act on wrong DIMM data.

How to fix it

Upgrade the Linux kernel to a version containing the fix that declares mem_ctrl_idx as 64 bits wide before the left-shift operation.

How to confirm the fix worked

Inspect the EDAC BlueField source for the variable declaration change to u64, recompile, and confirm the SMC argument calculation now preserves all 64 bits for indices that previously overflowed.

Typical attack path

1. Obtain code execution or the ability to invoke the affected EDAC SMC path on a vulnerable kernel
2. Craft a mem_ctrl_idx whose upper 16 bits matter for the DIMM lookup
3. Observe truncated DIMM information returned or used by the driver

How to detect it

Search kernel logs and SMC traces for BlueField EDAC calls that reference unexpectedly high or truncated controller indices; compare against source history to identify builds still containing the 32-bit variable.

What your security team should do

• Prioritize kernel updates on all BlueField-based systems
• Review internal kernel build and deployment pipelines for timely inclusion of upstream EDAC fixes
• Add kernel version checks to vulnerability scanning to surface remaining instances of the vulnerable code pattern