Linux bnxt_en driver (ethtool coredump / bnxt_get_coredump): Out-of-bounds memcpy when retrieving a firmware coredump

Impact

Out-of-bounds memcpy when retrieving a firmware coredump via ethtool — the returned DMA length can exceed the buffer the driver allocated, corrupting kernel memory. What makes this operationally awkward is that ethtool -w is exactly what your support workflow runs when a NIC misbehaves, so the diagnostic step is the trigger.

Who can reach it

Local privileged user running an ethtool coredump against the NIC, with firmware returning an over-long length. Relevant if tenants have root on bare metal, or if a compromised NIC firmware can influence the returned length.

What to do

Kernel/driver upgrade plus host reboot. Until patched, avoid ethtool -w on Broadcom NICs in your automated diagnostics.

References