Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

CVE-2025-39810

bnxt_en: Fix memory corruption when FW resources change during ifdown

HIGH 7.8

En bref

Source
NVD
EPSS
EPSS 0.20 % · centile 10 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Modified

Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1. In the FW resource or capability change scenario, the FW will return flags in bnxt_hwrm_if_change() that will cause the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will cause bp->tx_ring[] to be sized too small and cause memory corruption in bnxt_alloc_cp_rings(). Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

Faiblesses (CWE)

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Linux · Linuxaffected ec5d31e3c15d5233b491400133c67f78a320062c < dc797a4bbbcac6d19e6e2508e4df685755cd94a5 ; affected ec5d31e3c15d5233b491400133c67f78a320062c < d00e98977ef519280b075d783653e2c492fffbb6 ; affected ec5d31e3c15d5233b491400133c67f78a320062c < 9ab6a9950f152e094395d2e3967f889857daa185 ; affected ec5d31e3c15d5233b491400133c67f78a320062c < 2747328ba2714f1a7454208dbbc1dc0631990b4a
Linux · Linuxaffected 5.4 ; unaffected 0 < 5.4 ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.45 ≤ 6.12.* ; unaffected 6.16.5 ≤ 6.16.* ; unaffected 6.17 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD