Linux kernel RDMA connection manager drivers/infiniband/core/cma.c - cma_req_handler (RoCE): Pre-authentication remote

CVSS 6.5CVE-2014-2739Firmware, BMC & network fabriccurated

Impact

Pre-authentication remote crash of any node running an RDMA-CM listener. Crafted RoCE connection-request traffic drives cma_req_handler down an address-resolution path owned by a different module, the pointer is wrong, and the kernel panics. The isolation lesson matters more than the crash: the RDMA connection manager accepts and parses attacker-controlled connection requests before any authentication exists, so on a shared fabric every node's kernel is parsing untrusted input from every tenant by design. One tenant reboots a rack's worth of training nodes and takes out everyone's in-flight jobs and their unsaved optimizer state.

Who can reach it

Adjacent network, pre-auth. Any host on the RoCE/IB fabric that can reach the node's RDMA-CM listener. No credentials and no account on the target.

What to do

Kernel upgrade past 3.14.1 or a vendor backport; rolling reboot. The structural fix that outlives this one CVE is fabric segmentation - keep the RDMA control plane on a dedicated, tenant-unreachable L2 domain, and where the fabric must be shared, use partition keys (IB P_Keys) or RoCE VLAN isolation so tenants cannot address each other's CM listeners at all. RDMA-CM itself has no authentication to turn on.

References

https://access.redhat.com/security/cve/CVE-2014-2739 https://bugzilla.redhat.com/show_bug.cgi?id=1088078 https://nvd.nist.gov/vuln/detail/CVE-2014-2739

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.