CVE-2024-57936

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-57936", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-01-19T11:50:08.377Z", "datePublished": "2025-01-21T12:01:31.907Z", "dateUpdated": "2026-10-15T21:51:49.858Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:59.812Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Fix max SGEs for the Work Request\n\nGen P7 supports up to 13 SGEs for now. WQE software structure\ncan hold only 6 now. Since the max send sge is reported as\n13, the stack can give requests up to 13 SGEs. This is causing\ntraffic failures and system crashes.\n\nUse the define for max SGE supported for variable size. This\nwill work for both static and variable WQEs."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - Kernel RDMA target ULPs (nvmet-rdma, NFS/RDMA server via svcrdma, iSER/SRP) build work requests through `rdma_rw_init_map_wrs()` with up to 13 SGEs \u2014 bnxt_re does not set `max_sgl_rd`, so the multi-SGE (non-MR) path is always taken on RoCE \u2014 meaning a remote initiator's ordinary I/O with \u22657 scatterlist entries drives the overflow on the server over routable RoCEv2 (UDP/4791). The same code is also reachable locally via world-readable `/dev/infiniband/uverbs*`.\nAC:L - There is no race and no dependence on memory layout the attacker cannot influence \u2014 creating a QP with `cap.max_send_sge > 6` (or simply issuing a multi-segment I/O against an RDMA target) and posting one work request deterministically overruns the 6-entry stack array every time.\nPR:N - On the remote path an NVMe-oF/RDMA or NFS/RDMA client needs no privileges on the target host and nvmet accepts connections with no cryptographic authentication by default, so the >6-SGE work request is built by the victim kernel purely in response to unauthenticated peer I/O.\nUI:N - No victim action is required; the malicious work request is processed automatically by the target's RDMA queue-pair handling or by the attacker's own `ib_uverbs_post_send()` call.\nS:U - The out-of-bounds stack write, the wild `pbl_ptr[]` write and the resulting corruption all occur within the kernel's own security authority, with no hypervisor or IOMMU boundary being crossed.\nC:H - The clobbered `wqe.num_sge` makes `bnxt_qplib_put_sges()` read up to ~1 MB past the 272-byte stack object and copy that kernel stack content into the DMA-visible send queue for the NIC to consume, and the write primitive additionally supports arbitrary kernel memory disclosure.\nI:H - `bnxt_re_build_sgl()` writes fully attacker-controlled 64-bit values past a 96-byte on-stack array \u2014 unbounded in the VARIABLE-mode user-QP path where `sq->max_sge` is never clamped \u2014 smashing the stack canary, saved registers and return addresses, a classic control-flow-hijack primitive.\nA:H - The commit itself states the condition causes \"traffic failures and system crashes\"; the out-of-bounds stack access and the wild pointer write through the unbounded hardware-queue index reliably oops or panic the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/bnxt_re/qplib_fp.h"], "versions": [{"version": "36e1b6890f228ccfc867031ecedffe50958b25e4", "lessThan": "3de1b50f055dc2ca7072a526cdda21f691c22dd9", "status": "affected", "versionType": "git"}, {"version": "227f51743b61fe3f6fc481f0fb8086bf8c49b8c9", "lessThan": "9a479088e0c8f6140b8c7752b563bc8c6c6dcc8c", "status": "affected", "versionType": "git"}, {"version": "227f51743b61fe3f6fc481f0fb8086bf8c49b8c9", "lessThan": "79d330fbdffd8cee06d8bdf38d82cb62d8363a27", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/bnxt_re/qplib_fp.h"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.9", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3de1b50f055dc2ca7072a526cdda21f691c22dd9"}, {"url": "https://git.kernel.org/stable/c/9a479088e0c8f6140b8c7752b563bc8c6c6dcc8c"}, {"url": "https://git.kernel.org/stable/c/79d330fbdffd8cee06d8bdf38d82cb62d8363a27"}], "title": "RDMA/bnxt_re: Fix max SGEs for the Work Request", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-57936", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:41:46.358439Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:49.858Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-57936", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:41:46.358439Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:46.968Z"}}], "cna": {"title": "RDMA/bnxt_re: Fix max SGEs for the Work Request", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - Kernel RDMA target ULPs (nvmet-rdma, NFS/RDMA server via svcrdma, iSER/SRP) build work requests through `rdma_rw_init_map_wrs()` with up to 13 SGEs \u2014 bnxt_re does not set `max_sgl_rd`, so the multi-SGE (non-MR) path is always taken on RoCE \u2014 meaning a remote initiator's ordinary I/O with \u22657 scatterlist entries drives the overflow on the server over routable RoCEv2 (UDP/4791). The same code is also reachable locally via world-readable `/dev/infiniband/uverbs*`.\nAC:L - There is no race and no dependence on memory layout the attacker cannot influence \u2014 creating a QP with `cap.max_send_sge > 6` (or simply issuing a multi-segment I/O against an RDMA target) and posting one work request deterministically overruns the 6-entry stack array every time.\nPR:N - On the remote path an NVMe-oF/RDMA or NFS/RDMA client needs no privileges on the target host and nvmet accepts connections with no cryptographic authentication by default, so the >6-SGE work request is built by the victim kernel purely in response to unauthenticated peer I/O.\nUI:N - No victim action is required; the malicious work request is processed automatically by the target's RDMA queue-pair handling or by the attacker's own `ib_uverbs_post_send()` call.\nS:U - The out-of-bounds stack write, the wild `pbl_ptr[]` write and the resulting corruption all occur within the kernel's own security authority, with no hypervisor or IOMMU boundary being crossed.\nC:H - The clobbered `wqe.num_sge` makes `bnxt_qplib_put_sges()` read up to ~1 MB past the 272-byte stack object and copy that kernel stack content into the DMA-visible send queue for the NIC to consume, and the write primitive additionally supports arbitrary kernel memory disclosure.\nI:H - `bnxt_re_build_sgl()` writes fully attacker-controlled 64-bit values past a 96-byte on-stack array \u2014 unbounded in the VARIABLE-mode user-QP path where `sq->max_sge` is never clamped \u2014 smashing the stack canary, saved registers and return addresses, a classic control-flow-hijack primitive.\nA:H - The commit itself states the condition causes \"traffic failures and system crashes\"; the out-of-bounds stack access and the wild pointer write through the unbounded hardware-queue index reliably oops or panic the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "36e1b6890f228ccfc867031ecedffe50958b25e4", "lessThan": "3de1b50f055dc2ca7072a526cdda21f691c22dd9", "versionType": "git"}, {"status": "affected", "version": "227f51743b61fe3f6fc481f0fb8086bf8c49b8c9", "lessThan": "9a479088e0c8f6140b8c7752b563bc8c6c6dcc8c", "versionType": "git"}, {"status": "affected", "version": "227f51743b61fe3f6fc481f0fb8086bf8c49b8c9", "lessThan": "79d330fbdffd8cee06d8bdf38d82cb62d8363a27", "versionType": "git"}], "programFiles": ["drivers/infiniband/hw/bnxt_re/qplib_fp.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.9", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/hw/bnxt_re/qplib_fp.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3de1b50f055dc2ca7072a526cdda21f691c22dd9"}, {"url": "https://git.kernel.org/stable/c/9a479088e0c8f6140b8c7752b563bc8c6c6dcc8c"}, {"url": "https://git.kernel.org/stable/c/79d330fbdffd8cee06d8bdf38d82cb62d8363a27"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Fix max SGEs for the Work Request\n\nGen P7 supports up to 13 SGEs for now. WQE software structure\ncan hold only 6 now. Since the max send sge is reported as\n13, the stack can give requests up to 13 SGEs. This is causing\ntraffic failures and system crashes.\n\nUse the define for max SGE supported for variable size. This\nwill work for both static and variable WQEs."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.9", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13", "versionStartIncluding": "6.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:59.812Z"}}}, "cveMetadata": {"cveId": "CVE-2024-57936", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:51:49.858Z", "dateReserved": "2025-01-19T11:50:08.377Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-01-21T12:01:31.907Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/bnxt_re/qplib_fp.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3de1b50f055dc2ca7072a526cdda21f691c22dd9", "status": "affected", "version": "36e1b6890f228ccfc867031ecedffe50958b25e4", "versionType": "git"}, {"lessThan": "9a479088e0c8f6140b8c7752b563bc8c6c6dcc8c", "status": "affected", "version": "227f51743b61fe3f6fc481f0fb8086bf8c49b8c9", "versionType": "git"}, {"lessThan": "79d330fbdffd8cee06d8bdf38d82cb62d8363a27", "status": "affected", "version": "227f51743b61fe3f6fc481f0fb8086bf8c49b8c9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/bnxt_re/qplib_fp.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "16BF7562-19ED-47A6-8C30-DE19CE50DB7C", "versionEndExcluding": "6.12.9", "versionStartIncluding": "6.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*", "matchCriteriaId": "5A073481-106D-4B15-B4C7-FB0213B8E1D4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*", "matchCriteriaId": "DE491969-75AE-4A6B-9A58-8FC5AF98798F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*", "matchCriteriaId": "93C0660D-7FB8-4FBA-892A-B064BA71E49E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*", "matchCriteriaId": "034C36A6-C481-41F3-AE9A-D116E5BE6895", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Fix max SGEs for the Work Request\n\nGen P7 supports up to 13 SGEs for now. WQE software structure\ncan hold only 6 now. Since the max send sge is reported as\n13, the stack can give requests up to 13 SGEs. This is causing\ntraffic failures and system crashes.\n\nUse the define for max SGE supported for variable size. This\nwill work for both static and variable WQEs."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/bnxt_re: Se corrige el n\u00famero m\u00e1ximo de SGE para la solicitud de trabajo. La generaci\u00f3n P7 admite hasta 13 SGE por ahora. La estructura de software de WQE solo puede admitir 6 ahora. Dado que el n\u00famero m\u00e1ximo de SGE de env\u00edo se informa como 13, la pila puede dar solicitudes de hasta 13 SGE. Esto est\u00e1 causando fallas de tr\u00e1fico y bloqueos del sistema. Utilice la definici\u00f3n para el n\u00famero m\u00e1ximo de SGE admitidos para el tama\u00f1o variable. Esto funcionar\u00e1 tanto para WQE est\u00e1ticos como variables."}], "id": "CVE-2024-57936", "lastModified": "2026-10-15T22:18:04.303", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-57936", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:41:46.358439Z", "version": "2.0.3"}}]}, "published": "2025-01-21T12:15:27.257", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3de1b50f055dc2ca7072a526cdda21f691c22dd9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/79d330fbdffd8cee06d8bdf38d82cb62d8363a27"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9a479088e0c8f6140b8c7752b563bc8c6c6dcc8c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: RDMA/bnxt_re: Fix max SGEs for the Work Request", "id": "2339128", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339128"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/bnxt_re: Fix max SGEs for the Work Request\nGen P7 supports up to 13 SGEs for now. WQE software structure\ncan hold only 6 now. Since the max send sge is reported as\n13, the stack can give requests up to 13 SGEs. This is causing\ntraffic failures and system crashes.\nUse the define for max SGE supported for variable size. This\nwill work for both static and variable WQEs."], "name": "CVE-2024-57936", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-01-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-57936\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-57936\nhttps://lore.kernel.org/linux-cve-announce/2025012149-CVE-2024-57936-03a6@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-07-13T11:22:27.841732+00:00", "updated": "2025-07-13T11:22:27.841786+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}