Out of Bounds Check Vulnerability in Linux Kernel (Debian:13 & Debian:14)
Summary
DEBIAN-CVE-2024-50158: In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix out of bound check Driver exports pacing stats only on GenP5 and P7 adapters. Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability specifically affects the RDMA/bnxt_re driver, which is used for Remote Direct Memory Access in networking, particularly on GenP5 and P7 adapters. The vulnerability arises from improper checks in the driver code, leading to potential out-of-bounds memory access.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the RDMA/bnxt_re driver, where an out-of-bounds check can occur during the parsing of pacing statistics. This issue arises when the driver attempts to access memory locations that are not allocated, particularly when KASAN (Kernel Address Sanitizer) is enabled. The result is a trace and a potential crash, as the driver writes to an invalid memory address, which can lead to system instability or exploitation by malicious actors.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to ensure system security.
Conclusion
The out-of-bounds check vulnerability in the Linux kernel's RDMA/bnxt_re driver poses significant risks to system stability and security. Users are urged to update to the patched version to protect their systems from potential exploitation. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an out-of-bounds memory access issue in the RDMA/bnxt_re driver of the Linux kernel.
Exploitation of this vulnerability can lead to system crashes, instability, or unauthorized access to system resources.
Yes, the vulnerability has been fixed in version 6.11.6-1 of the Linux package.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate risks.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
