Vulnerability-Lookup

GHSA-57XX-4R4J-43P7

Vulnerability from github – Published: 2024-11-08 06:30 – Updated: 2025-11-04 00:31

Details

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages

Avoid memory corruption while setting up Level-2 PBL pages for the non MR resources when num_pages > 256K.

There will be a single PDE page address (contiguous pages in the case of > PAGE_SIZE), but, current logic assumes multiple pages, leading to invalid memory access after 256K PBL entries in the PDE.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-50208"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-08T06:15:17Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages\n\nAvoid memory corruption while setting up Level-2 PBL pages for the non MR\nresources when num_pages \u003e 256K.\n\nThere will be a single PDE page address (contiguous pages in the case of \u003e\nPAGE_SIZE), but, current logic assumes multiple pages, leading to invalid\nmemory access after 256K PBL entries in the PDE.",
  "id": "GHSA-57xx-4r4j-43p7",
  "modified": "2025-11-04T00:31:58Z",
  "published": "2024-11-08T06:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50208"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7988bdbbb85ac85a847baf09879edcd0f70521dc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/87cb3b0054e53e0155b630bdf8fb714ded62565f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/daac56dd98e1ba814c878ac0acd482a37f2ab94b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/de5857fa7bcc9a496a914c7e21390be873109f26"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/df6fed0a2a1a5e57f033bca40dc316b18e0d0ce6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ea701c1849e7250ea41a4f7493e0a5f136c1d47e"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-50208 (GCVE-0-2024-50208)

Vulnerability from cvelistv5 – Published: 2024-11-08 06:07 – Updated: 2026-08-05 11:42

Title

RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages Avoid memory corruption while setting up Level-2 PBL pages for the non MR resources when num_pages > 256K. There will be a single PDE page address (contiguous pages in the case of > PAGE_SIZE), but, current logic assumes multiple pages, leading to invalid memory access after 256K PBL entries in the PDE.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-01 20:17 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

Linux mitre root Scorecard

References

8 references

URL	Tags
https://git.kernel.org/stable/c/df6fed0a2a1a5e57f…
https://git.kernel.org/stable/c/de5857fa7bcc9a496…
https://git.kernel.org/stable/c/ea701c1849e7250ea…
https://git.kernel.org/stable/c/87cb3b0054e53e015…
https://git.kernel.org/stable/c/daac56dd98e1ba814…
https://git.kernel.org/stable/c/7988bdbbb85ac85a8…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0c4dcd602817502bb3dced7a834a13ef717d65a4 , < df6fed0a2a1a5e57f033bca40dc316b18e0d0ce6 (git) Affected: 0c4dcd602817502bb3dced7a834a13ef717d65a4 , < de5857fa7bcc9a496a914c7e21390be873109f26 (git) Affected: 0c4dcd602817502bb3dced7a834a13ef717d65a4 , < ea701c1849e7250ea41a4f7493e0a5f136c1d47e (git) Affected: 0c4dcd602817502bb3dced7a834a13ef717d65a4 , < 87cb3b0054e53e0155b630bdf8fb714ded62565f (git) Affected: 0c4dcd602817502bb3dced7a834a13ef717d65a4 , < daac56dd98e1ba814c878ac0acd482a37f2ab94b (git) Affected: 0c4dcd602817502bb3dced7a834a13ef717d65a4 , < 7988bdbbb85ac85a847baf09879edcd0f70521dc (git)
Linux	Linux	Affected: 5.7 Unaffected: 0 , < 5.7 (semver) Unaffected: 5.10.229 , ≤ 5.10.* (semver) Unaffected: 5.15.170 , ≤ 5.15.* (semver) Unaffected: 6.1.115 , ≤ 6.1.* (semver) Unaffected: 6.6.59 , ≤ 6.6.* (semver) Unaffected: 6.11.6 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50208",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:17:28.760065Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:27:06.387Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:27:02.268Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/bnxt_re/qplib_res.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "df6fed0a2a1a5e57f033bca40dc316b18e0d0ce6",
              "status": "affected",
              "version": "0c4dcd602817502bb3dced7a834a13ef717d65a4",
              "versionType": "git"
            },
            {
              "lessThan": "de5857fa7bcc9a496a914c7e21390be873109f26",
              "status": "affected",
              "version": "0c4dcd602817502bb3dced7a834a13ef717d65a4",
              "versionType": "git"
            },
            {
              "lessThan": "ea701c1849e7250ea41a4f7493e0a5f136c1d47e",
              "status": "affected",
              "version": "0c4dcd602817502bb3dced7a834a13ef717d65a4",
              "versionType": "git"
            },
            {
              "lessThan": "87cb3b0054e53e0155b630bdf8fb714ded62565f",
              "status": "affected",
              "version": "0c4dcd602817502bb3dced7a834a13ef717d65a4",
              "versionType": "git"
            },
            {
              "lessThan": "daac56dd98e1ba814c878ac0acd482a37f2ab94b",
              "status": "affected",
              "version": "0c4dcd602817502bb3dced7a834a13ef717d65a4",
              "versionType": "git"
            },
            {
              "lessThan": "7988bdbbb85ac85a847baf09879edcd0f70521dc",
              "status": "affected",
              "version": "0c4dcd602817502bb3dced7a834a13ef717d65a4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/bnxt_re/qplib_res.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.170",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.229",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.170",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.115",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.59",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages\n\nAvoid memory corruption while setting up Level-2 PBL pages for the non MR\nresources when num_pages \u003e 256K.\n\nThere will be a single PDE page address (contiguous pages in the case of \u003e\nPAGE_SIZE), but, current logic assumes multiple pages, leading to invalid\nmemory access after 256K PBL entries in the PDE."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable HWQ allocator is reached through the local RDMA verbs uAPI (`/dev/infiniband/uverbs*` ioctl/write: create_cq, create_qp, create_srq, resize_cq), which requires local system access. A remote RoCE peer cannot choose queue depths, so no network-triggered path exists.\nAC:L - The attacker fully controls the single condition needed \u2014 the requested queue depth \u2014 and can deterministically request a CQ/QP whose PTE count exceeds 256K pages, since the driver\u0027s only bound is the firmware-reported `max_cq_wqes`, which was uncapped in all affected versions. No race or unpredictable state is involved in reaching the faulty loop.\nPR:L - The kernel exposes the uverbs character devices with mode 0666 (`uverbs_devnode()`), and RDMA/HPC and container deployments routinely grant unprivileged users direct verbs access \u2014 that is the entire point of user-space kernel bypass. No root or capability is required to issue a create_cq/create_qp request.\nUI:N - The attacker triggers the oversized queue allocation entirely from its own process; no action by any other user or administrator is needed. Exploitation completes within a single verbs call sequence.\nS:U - The uninitialized-pointer write and the resulting corruption occur within the kernel\u0027s own memory and security authority. Although the misprogrammed PDE also causes device DMA to unintended physical addresses, this remains within the host kernel\u0027s authority rather than crossing a VM or sandbox boundary.\nC:H - The bug reads uninitialized vmalloc slots and hands the adapter a PDE whose upper entries are uninitialized DMA memory, so the NIC dereferences arbitrary physical addresses as page-table pages, allowing kernel memory to be DMA\u0027d out; the resulting memory corruption is likewise leverageable for arbitrary read.\nI:H - Writing `src_phys_ptr[i] | PTU_PDE_VALID` through an uninitialized pointer is an arbitrary/wild kernel write of a semi-controlled 64-bit value across up to 512 consecutive slots, and the stale vmalloc page contents can be groomed by the attacker via the page allocator, yielding a control-flow-hijacking primitive.\nA:H - In the common case the stale pointer is NULL (or non-canonical), producing an immediate kernel oops/panic on a fault in the write loop; any successful trigger corrupts kernel memory or programs the NIC with garbage PBL addresses, reliably crashing the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:31.470Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/df6fed0a2a1a5e57f033bca40dc316b18e0d0ce6"
        },
        {
          "url": "https://git.kernel.org/stable/c/de5857fa7bcc9a496a914c7e21390be873109f26"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea701c1849e7250ea41a4f7493e0a5f136c1d47e"
        },
        {
          "url": "https://git.kernel.org/stable/c/87cb3b0054e53e0155b630bdf8fb714ded62565f"
        },
        {
          "url": "https://git.kernel.org/stable/c/daac56dd98e1ba814c878ac0acd482a37f2ab94b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7988bdbbb85ac85a847baf09879edcd0f70521dc"
        }
      ],
      "title": "RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50208",
    "datePublished": "2024-11-08T06:07:58.607Z",
    "dateReserved": "2024-10-21T19:36:19.970Z",
    "dateUpdated": "2026-08-05T11:42:31.470Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-57XX-4R4J-43P7

CVE-2024-50208 (GCVE-0-2024-50208)

Tags

Sightings

Nomenclature

Related by attack behaviour