GPU VulnDB

Database/Firmware, BMC & network fabric

Linux kernel InfiniBand uverbs drivers/infiniband/core/uverbs_cmd.c - ib_uverbs_poll_cq: Integer overflow on the

CVSS 7.8CVE-2010-4649Firmware, BMC & network fabriccurated

Impact

Integer overflow on the completion-queue poll path. A tenant passes an oversized entry count through the uverbs POLL_CQ command, the size computation wraps, and the kernel corrupts memory past the allocation - a heap-corruption primitive available to anyone holding the uverbs device node, with privilege escalation not excluded. Historically important because it is the first of the uverbs command-argument overflows and it establishes the pattern that CVE-2014-8159 and CVE-2016-8636 repeat: the verbs uAPI trusted tenant-supplied sizes.

Who can reach it

Local, unprivileged - read/write on /dev/infiniband/uverbsN, i.e. any RDMA-enabled tenant container.

What to do

Kernel upgrade past 2.6.37 or a vendor backport; rolling reboot. Any fleet still exposed to this is running a kernel a decade and a half old, so the operator decision is really a platform upgrade, not a patch. Interim control is the same as for the other uverbs bugs: stop mapping /dev/infiniband/uverbs* into untrusted workloads.

References

https://access.redhat.com/security/cve/CVE-2010-4649https://bugzilla.redhat.com/show_bug.cgi?id=666556https://nvd.nist.gov/vuln/detail/CVE-2010-4649

Related entries

All Firmware, BMC & network fabric entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.