RDMA/irdma: Prevent user-triggered null deref on QP create
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.114, 6.18.42, 7.1.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp. While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref. Fix this by unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From b48c24c2d710cf34810c555dcef883a3d35a9c08 · fixed in d52ff592abfcd56234f266aa245c489f70b1c554; From b48c24c2d710cf34810c555dcef883a3d35a9c08 · fixed in ad68e0b759f9569f0dfea84f035c91eadb979802; From b48c24c2d710cf34810c555dcef883a3d35a9c08 · fixed in ec675b4cdfd378d8c9dd8c93126c024f2469bd79; From b48c24c2d710cf34810c555dcef883a3d35a9c08 · fixed in 728211c815f6eef28dd3df2a5b6297483185aa20; From b48c24c2d710cf34810c555dcef883a3d35a9c08 · fixed in b9b0889071569d43623c260074e159cd8f26adb1
- Linux Linux
5.14
- KernelLinux
From 5.14.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.42; From 6.19.0 · fixed in 7.1.6