Listen to this Post
This vulnerability exists in the `bnxt_en` network driver of the Linux kernel. During an interface shutdown (ifdown), if the firmware (FW) signals a change in its capabilities or resources, the driver reinitializes. This triggers `bnxt_cancel_reservations()` and eventually calls bnxt_init_dflt_ring_mode(), which invokes bnxt_set_dflt_rings(). This function contains a flawed assumption that it executes only before any Traffic Class (TC) structures are created, meaning `bp->num_tc` (the number of TCs) should be 0 or 1. However, in this reinitialization path, `bp->num_tc` can be greater than 1 if TCs were previously configured. The function fails to scale the allocation size of the `bp->tx_ring[]` array by bp->num_tc. Consequently, the array is allocated too small. Later, `bnxt_alloc_cp_rings()` writes ring pointers into this undersized array based on the actual, larger `bp->num_tc` value, causing memory corruption beyond the array’s bounds and leading to system instability or crashes.
Platform: Linux Kernel
Version: With bnxt_en
Vulnerability: Memory Corruption
Severity: High
date: 2025-09-16
Prediction: 2025-10-14
What Undercode Say:
Check loaded kernel version uname -r List kernel modules, filter for bnxt lsmod | grep bnxt Check dmesg for driver/firmware messages dmesg | tail -50 | grep -i "bnxt|firmware" Example vulnerable code pattern (conceptual) In bnxt_set_dflt_rings(): bp->tx_nr_rings = bp->pf.tx_rings; // Missing multiplication by bp->num_tc bp->tx_ring = kcalloc(bp->tx_nr_rings, ...);
How Exploit:
// Conceptual PoC causing crash while true; do ip link set dev <BNXT_IF> down Trigger FW resource change simulation ip link set dev <BNXT_IF> up done Exploits race condition during reinit, corrupting adjacent kernel memory.
Protection from this CVE
Apply kernel patch fixing `bnxt_set_dflt_rings()` scaling.
Update to kernel versions containing commit 4a1d5e4d.
Avoid dynamic FW changes during admin operations.
Impact:
Kernel panic, system crash, denial-of-service, potential privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
