CVE-2024-56656

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips

The 5760X (P7) chip's HW GRO/LRO interface is very similar to that of

the previous generation (5750X or P5). However, the aggregation ID

fields in the completion structures on P7 have been redefined from

16 bits to 12 bits. The freed up 4 bits are redefined for part of the

metadata such as the VLAN ID. The aggregation ID mask was not modified

when adding support for P7 chips. Including the extra 4 bits for the

aggregation ID can potentially cause the driver to store or fetch the

packet header of GRO/LRO packets in the wrong TPA buffer. It may hit

the BUG() condition in __skb_pull() because the SKB contains no valid

packet header:

kernel BUG at include/linux/skbuff.h:2766!

Oops: invalid opcode: 0000 1 PREEMPT SMP NOPTI

CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Kdump: loaded Tainted: G OE 6.12.0-rc2+ #7

Tainted: [O]=OOT_MODULE, [E]=UNSIGNED

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References