CVE-2024-57936 (GCVE-0-2024-57936)

Vulnerability from cvelistv5 – Published: 2025-01-21 12:01 – Updated: 2026-08-05 11:46
VLAI
Title
RDMA/bnxt_re: Fix max SGEs for the Work Request
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix max SGEs for the Work Request Gen P7 supports up to 13 SGEs for now. WQE software structure can hold only 6 now. Since the max send sge is reported as 13, the stack can give requests up to 13 SGEs. This is causing traffic failures and system crashes. Use the define for max SGE supported for variable size. This will work for both static and variable WQEs.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 36e1b6890f228ccfc867031ecedffe50958b25e4 , < 3de1b50f055dc2ca7072a526cdda21f691c22dd9 (git)
Affected: 227f51743b61fe3f6fc481f0fb8086bf8c49b8c9 , < 9a479088e0c8f6140b8c7752b563bc8c6c6dcc8c (git)
Affected: 227f51743b61fe3f6fc481f0fb8086bf8c49b8c9 , < 79d330fbdffd8cee06d8bdf38d82cb62d8363a27 (git)
Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.9 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/bnxt_re/qplib_fp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3de1b50f055dc2ca7072a526cdda21f691c22dd9",
              "status": "affected",
              "version": "36e1b6890f228ccfc867031ecedffe50958b25e4",
              "versionType": "git"
            },
            {
              "lessThan": "9a479088e0c8f6140b8c7752b563bc8c6c6dcc8c",
              "status": "affected",
              "version": "227f51743b61fe3f6fc481f0fb8086bf8c49b8c9",
              "versionType": "git"
            },
            {
              "lessThan": "79d330fbdffd8cee06d8bdf38d82cb62d8363a27",
              "status": "affected",
              "version": "227f51743b61fe3f6fc481f0fb8086bf8c49b8c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/bnxt_re/qplib_fp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.9",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Fix max SGEs for the Work Request\n\nGen P7 supports up to 13 SGEs for now. WQE software structure\ncan hold only 6 now. Since the max send sge is reported as\n13, the stack can give requests up to 13 SGEs. This is causing\ntraffic failures and system crashes.\n\nUse the define for max SGE supported for variable size. This\nwill work for both static and variable WQEs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Kernel RDMA target ULPs (nvmet-rdma, NFS/RDMA server via svcrdma, iSER/SRP) build work requests through `rdma_rw_init_map_wrs()` with up to 13 SGEs \u2014 bnxt_re does not set `max_sgl_rd`, so the multi-SGE (non-MR) path is always taken on RoCE \u2014 meaning a remote initiator\u0027s ordinary I/O with \u22657 scatterlist entries drives the overflow on the server over routable RoCEv2 (UDP/4791). The same code is also reachable locally via world-readable `/dev/infiniband/uverbs*`.\nAC:L - There is no race and no dependence on memory layout the attacker cannot influence \u2014 creating a QP with `cap.max_send_sge \u003e 6` (or simply issuing a multi-segment I/O against an RDMA target) and posting one work request deterministically overruns the 6-entry stack array every time.\nPR:N - On the remote path an NVMe-oF/RDMA or NFS/RDMA client needs no privileges on the target host and nvmet accepts connections with no cryptographic authentication by default, so the \u003e6-SGE work request is built by the victim kernel purely in response to unauthenticated peer I/O.\nUI:N - No victim action is required; the malicious work request is processed automatically by the target\u0027s RDMA queue-pair handling or by the attacker\u0027s own `ib_uverbs_post_send()` call.\nS:U - The out-of-bounds stack write, the wild `pbl_ptr[]` write and the resulting corruption all occur within the kernel\u0027s own security authority, with no hypervisor or IOMMU boundary being crossed.\nC:H - The clobbered `wqe.num_sge` makes `bnxt_qplib_put_sges()` read up to ~1 MB past the 272-byte stack object and copy that kernel stack content into the DMA-visible send queue for the NIC to consume, and the write primitive additionally supports arbitrary kernel memory disclosure.\nI:H - `bnxt_re_build_sgl()` writes fully attacker-controlled 64-bit values past a 96-byte on-stack array \u2014 unbounded in the VARIABLE-mode user-QP path where `sq-\u003emax_sge` is never clamped \u2014 smashing the stack canary, saved registers and return addresses, a classic control-flow-hijack primitive.\nA:H - The commit itself states the condition causes \"traffic failures and system crashes\"; the out-of-bounds stack access and the wild pointer write through the unbounded hardware-queue index reliably oops or panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:59.812Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3de1b50f055dc2ca7072a526cdda21f691c22dd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a479088e0c8f6140b8c7752b563bc8c6c6dcc8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/79d330fbdffd8cee06d8bdf38d82cb62d8363a27"
        }
      ],
      "title": "RDMA/bnxt_re: Fix max SGEs for the Work Request",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57936",
    "datePublished": "2025-01-21T12:01:31.907Z",
    "dateReserved": "2025-01-19T11:50:08.377Z",
    "dateUpdated": "2026-08-05T11:46:59.812Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-57936",
      "date": "2026-08-09",
      "epss": "0.00394",
      "percentile": "0.3215"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-57936\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-21T12:15:27.257\",\"lastModified\":\"2026-08-04T11:22:32.393\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/bnxt_re: Fix max SGEs for the Work Request\\n\\nGen P7 supports up to 13 SGEs for now. WQE software structure\\ncan hold only 6 now. Since the max send sge is reported as\\n13, the stack can give requests up to 13 SGEs. This is causing\\ntraffic failures and system crashes.\\n\\nUse the define for max SGE supported for variable size. This\\nwill work for both static and variable WQEs.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/bnxt_re: Se corrige el n\u00famero m\u00e1ximo de SGE para la solicitud de trabajo. La generaci\u00f3n P7 admite hasta 13 SGE por ahora. La estructura de software de WQE solo puede admitir 6 ahora. Dado que el n\u00famero m\u00e1ximo de SGE de env\u00edo se informa como 13, la pila puede dar solicitudes de hasta 13 SGE. Esto est\u00e1 causando fallas de tr\u00e1fico y bloqueos del sistema. Utilice la definici\u00f3n para el n\u00famero m\u00e1ximo de SGE admitidos para el tama\u00f1o variable. Esto funcionar\u00e1 tanto para WQE est\u00e1ticos como variables.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/hw/bnxt_re/qplib_fp.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"36e1b6890f228ccfc867031ecedffe50958b25e4\",\"lessThan\":\"3de1b50f055dc2ca7072a526cdda21f691c22dd9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"227f51743b61fe3f6fc481f0fb8086bf8c49b8c9\",\"lessThan\":\"9a479088e0c8f6140b8c7752b563bc8c6c6dcc8c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"227f51743b61fe3f6fc481f0fb8086bf8c49b8c9\",\"lessThan\":\"79d330fbdffd8cee06d8bdf38d82cb62d8363a27\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/hw/bnxt_re/qplib_fp.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.9\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.9\",\"matchCriteriaId\":\"16BF7562-19ED-47A6-8C30-DE19CE50DB7C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3de1b50f055dc2ca7072a526cdda21f691c22dd9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/79d330fbdffd8cee06d8bdf38d82cb62d8363a27\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a479088e0c8f6140b8c7752b563bc8c6c6dcc8c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:40:15+00:00",
      "cve": "CVE-2024-57936",
      "id": "CVE-2024-57936",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_affected": "136",
      "product_status:known_not_affected": "138",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/bnxt_re: Fix max SGEs for the Work Request",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-57936.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:13:29Z",
      "cve": "CVE-2024-57936",
      "id": "CVE-2024-57936",
      "initial_release_date": "2025-01-22T03:48:56Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "274",
      "product_status:recommended": "363",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-57936",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-57936.json",
      "version": "56"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.