CVE-2024-57936

What it actually does

The vulnerability arises because the bnxt_re RDMA driver reports support for up to 13 scatter-gather elements (SGEs) per work request while the WQE software structure can only hold 6, allowing the RDMA stack to submit oversized requests that exceed allocated buffers and trigger out-of-bounds memory access leading to crashes or traffic failures.

Why it matters to the business

Systems using affected Broadcom network adapters for RDMA workloads experience sudden traffic failures and kernel crashes that can interrupt high-performance networking, storage, or compute clusters; the issue is limited to specific hardware and older kernel branches, with low ecosystem-wide prevalence.

How an attack unfolds

An attacker able to issue RDMA work requests (typically via a local or compromised user-space application using the RDMA stack) submits requests containing 7–13 SGEs; the driver copies these into an undersized WQE structure, causing memory corruption or immediate system instability on Gen P7 hardware.

How to fix it

Upgrade to Linux kernel 6.12.9 or later; for source trees apply commit 3de1b50f055dc2ca7072a526cdda21f691c22dd9 which enforces the correct maximum SGE value for both static and variable-size WQEs.

How to confirm the fix worked

Confirm the running kernel is at least 6.12.9, verify the bnxt_re driver source contains the max-SGE define usage, and test that RDMA connection establishment and traffic succeed without crashes under maximum SGE load.

Typical attack path

1. Identify hosts running vulnerable Linux kernels with the bnxt_re driver loaded
2. Obtain local execution context capable of posting RDMA work requests
3. Construct and post a work request specifying more than 6 SGEs
4. Trigger the driver to process the oversized request, resulting in crash or traffic failure

How to detect it

Search kernel logs, dmesg, and systemd journal for oops or panic messages referencing bnxt_re, RDMA work requests, or SGE count mismatches; correlate with application logs showing failed RDMA operations on affected hardware.

What your security team should do

• Prioritize kernel upgrades on all systems exposing bnxt_re RDMA interfaces
• Temporarily disable RDMA interfaces or restrict user-space access on unpatched hosts
• Monitor kernel logs for bnxt_re-related oops and panics during RDMA activity
• Validate upgrade success by running RDMA stress tests with 13-SGE workloads