CVE-2024-57973

What it actually does

User-controlled gl->tot_len from process_responses() can cause integer wrap on 32-bit systems when added to sizeof(struct cpl_pass_accept_req) + sizeof(struct rss_header); size_add() now prevents the wrap that could corrupt memory calculations in rdma/cxgb4.

Why it matters to the business

On 32-bit Linux systems using cxgb4 RDMA, an attacker who can supply crafted responses may trigger memory corruption, crashes, or privilege escalation, potentially disrupting storage or high-performance networking workloads that rely on this driver.

How an attack unfolds

An attacker supplies a malicious response that sets gl->tot_len to a value that causes wrap-around during size addition inside the cxgb4 response handler; the resulting incorrect allocation or copy length leads to out-of-bounds memory access on 32-bit kernels.

How to fix it

Upgrade the Linux kernel to the commit 2b759f78b83221f4a1cae3aeb20b500e375f3ee6 or later stable releases that include the size_add() fix in drivers/infiniband/hw/cxgb4/

How to confirm the fix worked

Confirm the running kernel contains commit 2b759f78b83221f4a1cae3aeb20b500e375f3ee6; inspect drivers/infiniband/hw/cxgb4/ for use of size_add() around tot_len calculations and recompile or boot-test on 32-bit architecture.

Typical attack path

1. Attacker gains ability to influence RDMA response processing (local or via network depending on configuration)
2. Crafted cpl_pass_accept_req response sets gl->tot_len to trigger 32-bit addition wrap
3. size calculation underflows or overflows, producing invalid length for subsequent memory operation
4. Kernel performs out-of-bounds read/write or allocation, leading to corruption or crash

How to detect it

Review kernel logs for cxgb4 or rdma-related crashes or warnings around response processing; examine audit logs for unexpected RDMA connection attempts or memory-allocation failures on 32-bit hosts; no public exploit artifacts are known.

What your security team should do

• Prioritize patching 32-bit Linux systems that use cxgb4 RDMA hardware
• Apply the fixed commit or latest stable kernel containing 2b759f78b83221f4a1cae3aeb20b500e375f3ee6
• Disable cxgb4 RDMA interfaces where not required until patched
• Monitor for future similar integer-handling issues in other RDMA drivers