Linux kernel iWARP driver drivers/infiniband/hw/cxgb3/iwch_cm.c (Chelsio T3): Unauthenticated remote code execution in

Impact

Unauthenticated remote code execution in the kernel, reachable from the fabric. The iWARP connection-manager path mis-identifies an error condition and frees a buffer it then keeps using; a crafted packet to the listening RDMA endpoint drives the use-after-free to arbitrary kernel code execution. RDMA connection managers listen before any application-level authentication exists - there is no credential to present - so anything that can put packets on the storage/compute fabric owns the kernel. In a cluster where tenant traffic and RDMA control traffic share the same L2 domain, one compromised tenant VM reaches every node running this HCA.

Who can reach it

Network, pre-auth. Any host able to send packets to the node's iWARP/RDMA-CM listener - which on a flat cluster fabric includes every other tenant. No credentials, no prior foothold on the target.

What to do

Kernel upgrade to 4.5+ or a vendor backport of commit 67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3 (iw_cxgb3: fix incorrectly returning error on success). Rolling reboot required. Compensating control while you schedule it: put the RDMA fabric on its own isolated L2/VLAN with no tenant-reachable path, and firewall the iWARP listener - RDMA-CM has no authentication of its own, so network segmentation is the only pre-patch boundary. The iw_cxgb3 driver was removed from mainline entirely in later kernels; if you still have Chelsio T3 parts racked, that hardware is past end of support and should be scheduled out.

References