Log in Start free

Vulnerability · Published Jan 21, 2025 · Assigned by Linux

CVE-2024-57936RDMA/bnxt_re: Fix max SGEs for the Work Request

Critical 9.8

In plain English

A critical-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.4%top 65.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix max SGEs for the Work Request Gen P7 supports up to 13 SGEs for now. WQE software structure can hold only 6 now. Since the max send sge is reported as 13, the stack can give requests up to 13 SGEs. This is causing traffic failures and system crashes. Use the define for max SGE supported for variable size. This will work for both static and variable WQEs.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.9-1DEBIAN-CVE-2024-57936
Debian:14linux6.12.9-1DEBIAN-CVE-2024-57936
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-57936
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-57936
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-57936

Affected products (as reported)

VendorProductVersions
Linux Linux 36e1b6890f228ccfc867031ecedffe50958b25e4 – before 3de1b50f055dc2ca7072a526cdda21f691c22dd9227f51743b61fe3f6fc481f0fb8086bf8c49b8c9 – before 9a479088e0c8f6140b8c7752b563bc8c6c6dcc8c227f51743b61fe3f6fc481f0fb8086bf8c49b8c9 – before 79d330fbdffd8cee06d8bdf38d82cb62d8363a27
Linux Linux 6.12

References