Linux kernel InfiniBand uverbs drivers/infiniband/core/uverbs_cmd.c - ib_uverbs_poll_cq: Kernel memory disclosure

Impact

Kernel memory disclosure straight into a tenant's address space. The POLL_CQ response buffer is not zeroed before being copied out, so when fewer completions are returned than the buffer holds, the remaining bytes are whatever was previously in that kernel allocation - other tenants' RDMA metadata, pointers useful for defeating KASLR, and residual heap contents. A tenant can poll in a loop and harvest a continuous stream of kernel memory with no crash, no log entry, and no anomalous behaviour to detect. Low severity on paper, high value in practice as the reconnaissance step that makes the heap-corruption bugs on this same device node reliable.

Who can reach it

Local, unprivileged - /dev/infiniband/uverbsN access. Fully silent; nothing in the host's telemetry distinguishes it from normal verbs traffic.

What to do

Kernel upgrade past 2.6.37 or a vendor backport that memsets the response structure; rolling reboot. There is no runtime mitigation short of revoking uverbs access, because the leak happens in the normal, expected code path rather than an error path - you cannot rate-limit or alert your way out of it.

References