Executive brief
A vulnerability in the Linux kernel's bnx2x network driver can cause a system crash during specific error recovery scenarios. The bnx2x driver is used for Broadcom NetXtreme II Ethernet controllers commonly found in enterprise servers. An exploit of this flaw would lead to a complete denial of service, potentially disrupting network operations and server availability.
Technical details
A race condition exists in the bnx2x network driver during EEH (Enhanced Error Handling) recovery. The vulnerability is triggered when the transmit timeout logic (bnx2x_tx_timeout) schedules a reset task that overlaps with the EEH driver's own reset attempt (bnx2x_io_slot_reset). Both paths attempt to free Scatter-Gather Elements (SGEs), leading to a NULL pointer dereference when one thread accesses a memory location already cleared by the other. This results in a kernel oops and system crash. The fix involves verifying page pool allocations before attempting to free them to ensure the memory is still valid. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel 4.2 to 4.19.311, 4.20 to 5.4.273, 5.5 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2
Timeline
- 2024-03-15: patched: Initial patch submitted by Thinh Tran
- 2024-04-17: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/3a9f78b297e08ca8e88ae3ecff1f6fe2766dc5eb
- https://git.kernel.org/stable/c/44f9f1abb0ecc43023225ab9539167facbabf0ec
- https://git.kernel.org/stable/c/4f37d3a7e004bbf560c21441ca9c022168017ec4
- https://git.kernel.org/stable/c/7bcc090c81116c66936a7415f2c6b1483a4bcfd9
- https://git.kernel.org/stable/c/8eebff95ce9558be66a36aa7cfb43223f3ab4699
- https://git.kernel.org/stable/c/8ffcd3ccdbda0c918c4a0f922ef1c17010f1b598
- https://git.kernel.org/stable/c/c51f8b6930db3f259b8820b589f2459d2df3fc68