cbcvebase.
CVE-2024-42148
published 2024-07-30

CVE-2024-42148: In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fix multiple UBSAN array-index-out-of-bounds Fix UBSAN warnings that occur when…

PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.26%
17.5th percentile
In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fix multiple UBSAN array-index-out-of-bounds Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of Ethernet queues greater than or equal to FP_SB_MAX_E1x using the num_queues module parameter. Currently there is a read/write out of bounds that occurs on the array "struct stats_query_entry query" present inside the "bnx2x_fw_stats_req" struct in "drivers/net/ethernet/broadcom/bnx2x/bnx2x.h". Looking at the definition of the "struct stats_query_entry query" array: struct stats_query_entry query[FP_SB_MAX_E1x+ BNX2X_FIRST_QUEUE_QUERY_IDX]; FP_SB_MAX_E1x is defined as the maximum number of fast path interrupts and has a value of 16, while BNX2X_FIRST_QUEUE_QUERY_IDX has a value of 3 meaning the array has a total size of 19. Since accesses to "struct stats_query_entry query" are offset-ted by BNX2X_FIRST_QUEUE_QUERY_IDX, that means that the total number of Ethernet queues should not exceed FP_SB_MAX_E1x (16). However one of these queues is reserved for FCOE and thus the number of Ethernet queues should be set to [FP_SB_MAX_E1x -1] (15) if FCOE is enabled or [FP_SB_MAX_E1x] (16) if it is not. This is also described in a comment in the source code in drivers/net/ethernet/broadcom/bnx2x/bnx2x.h just above the Macro definition of FP_SB_MAX_E1x. Below is the part of this explanation that it important for this patch /* * The total number of L2 queues, MSIX vectors and HW contexts (CIDs) is * control by the number of fast-path status blocks supported by the * device (HW/FW). Each fast-path status block (FP-SB) aka non-default * status block represents an independent interrupts context that can * serve a regular L2 networking queue. However special L2 queues such * as the FCoE queue do not require a FP-SB and other components like * the CNIC may consume FP-SB reducing the number of possible L2 queues * * If the maximum number of F

Affected

25 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.98-1 (bookworm)linux 6.1.98-1 (bookworm)
debianlinux-6.1< linux 6.1.98-1 (bookworm)linux 6.1.98-1 (bookworm)
linuxlinux
linuxlinux>= 50f0a562f8cc9ed9d9f7f7380434c3c8646172d5 < cfb04472ce33bee2579caf4dc9f4242522f6e26ecfb04472ce33bee2579caf4dc9f4242522f6e26e
linuxlinux>= 50f0a562f8cc9ed9d9f7f7380434c3c8646172d5 < cbe53087026ad929cd3950508397e8892a6a2a0fcbe53087026ad929cd3950508397e8892a6a2a0f
linuxlinux>= 50f0a562f8cc9ed9d9f7f7380434c3c8646172d5 < 8b17cec33892a66bbd71f8d9a70a45e2072ae84f8b17cec33892a66bbd71f8d9a70a45e2072ae84f
linuxlinux>= 50f0a562f8cc9ed9d9f7f7380434c3c8646172d5 < 0edae06b4c227bcfaf3ce21208d49191e1009d3b0edae06b4c227bcfaf3ce21208d49191e1009d3b
linuxlinux>= 50f0a562f8cc9ed9d9f7f7380434c3c8646172d5 < 9504a1550686f53b0bab4cab31d435383b1ee2ce9504a1550686f53b0bab4cab31d435383b1ee2ce
linuxlinux>= 50f0a562f8cc9ed9d9f7f7380434c3c8646172d5 < f1313ea92f82451923e28ab45a4aaa0e70e80b98f1313ea92f82451923e28ab45a4aaa0e70e80b98
linuxlinux>= 50f0a562f8cc9ed9d9f7f7380434c3c8646172d5 < b9ea38e767459111a511ed4fb74abc37db95a59db9ea38e767459111a511ed4fb74abc37db95a59d
linuxlinux>= 50f0a562f8cc9ed9d9f7f7380434c3c8646172d5 < 134061163ee5ca4759de5c24ca3bd71608891ba7134061163ee5ca4759de5c24ca3bd71608891ba7
linuxlinux_kernel>= 0 < 5.10.223-15.10.223-1
linuxlinux_kernel>= 0 < 6.1.98-16.1.98-1
linuxlinux_kernel>= 0 < 6.9.9-16.9.9-1
linuxlinux_kernel>= 0 < 6.9.9-16.9.9-1
linuxlinux_kernel>= 0 < 5.4.0-195.2155.4.0-195.215
linuxlinux_kernel>= 0 < 5.15.0-121.1315.15.0-121.131
linuxlinux_kernel>= 0 < 6.8.0-44.446.8.0-44.44
linuxlinux_kernel>= 3.3 < 4.19.3184.19.318
linuxlinux_kernel>= 4.20 < 5.4.2805.4.280
linuxlinux_kernel>= 5.11 < 5.15.1635.15.163
linuxlinux_kernel>= 5.16 < 6.1.986.1.98
linuxlinux_kernel>= 5.5 < 5.10.2225.10.222
linuxlinux_kernel>= 6.2 < 6.6.396.6.39
linuxlinux_kernel>= 6.7 < 6.9.96.9.9

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.