CVE-2024-50172
📋 TL;DR
This CVE describes a memory leak vulnerability in the Linux kernel's RDMA bnxt_re driver. When the bnxt_qplib_map_db_bar() function fails during chip context setup, the driver doesn't free previously allocated memory, potentially leading to resource exhaustion. This affects systems using Broadcom NetXtreme-E RDMA adapters with the vulnerable driver.
💻 Affected Systems
- Linux kernel with bnxt_re RDMA driver
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Sustained exploitation could cause kernel memory exhaustion leading to system instability, denial of service, or potential kernel panic/crash.
Likely Case
Memory leak gradually consumes kernel resources, potentially causing performance degradation or system instability over time.
If Mitigated
With proper monitoring and resource limits, impact is limited to potential performance issues that can be detected and addressed.
🎯 Exploit Status
Exploitation requires triggering the specific failure condition in bnxt_qplib_map_db_bar() during RDMA setup. This is not a remote code execution vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in Linux kernel stable commits: 3fc5410f225d1651580a4aeb7c72f55e28673b53, 595fa9b17201028d35f92d450fc0ecda873fe469, 73e04a6114e08b5eb10e589e12b680955accb376
Vendor Advisory: https://git.kernel.org/stable/c/3fc5410f225d1651580a4aeb7c72f55e28673b53
Restart Required: Yes
Instructions:
1. Update to a Linux kernel version containing the fix commits. 2. Reboot the system to load the patched kernel. 3. Verify the bnxt_re driver is using the patched code.
🔧 Temporary Workarounds
Disable bnxt_re driver
linuxPrevent loading of the vulnerable driver if RDMA functionality is not required
echo 'blacklist bnxt_re' >> /etc/modprobe.d/blacklist.conf
update-initramfs -u
reboot
Disable RDMA functionality
linuxPrevent RDMA operations that could trigger the vulnerability
modprobe -r bnxt_re
echo 0 > /sys/module/bnxt_re/parameters/enable_rdma
🧯 If You Can't Patch
- Monitor kernel memory usage and system stability metrics for signs of memory leaks
- Implement process isolation and resource limits to contain potential impact
🔍 How to Verify
Check if Vulnerable:
Check if bnxt_re module is loaded: lsmod | grep bnxt_re. Check kernel version: uname -r and verify against patched versions.Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes fix commits. Check dmesg for bnxt_re driver loading without errors.📡 Detection & Monitoring
Log Indicators:
- Kernel OOM (Out of Memory) messages in dmesg
- Increasing kernel memory usage in system logs
- bnxt_re driver initialization failures
Network Indicators:
- None - this is a local memory management issue
SIEM Query:
source="kernel" AND ("Out of memory" OR "kernel: Out of memory" OR "bnxt_re" AND "error")