Database/Firmware, BMC & network fabric
Linux kernel SRP target drivers/infiniband/ulp/srpt/ib_srpt.c: An SRP initiator that issues an ABORT_TASK against an
Impact
An SRP initiator that issues an ABORT_TASK against an in-flight write dereferences NULL in the target and panics the box. In an InfiniBand cluster the SRP target is the shared block-storage head that many compute nodes mount, so a single tenant sending one malformed SCSI task-management command takes storage away from every job on the fabric simultaneously - the highest-fan-out DoS in an IB cluster. Worth cataloguing because the SRP protocol has no initiator authentication beyond fabric membership: if you are on the fabric, you are an authorized initiator.
Who can reach it
An SRP initiator on the fabric - i.e. any node or tenant permitted to mount SRP LUNs. Authorization is fabric membership, not a credential.
What to do
Kernel upgrade to 4.5.1+ on the storage target nodes, or a vendor backport; requires draining and rebooting the storage head, which for a single-headed SRP target means a storage outage unless the target is clustered. Longer-term control: restrict SRP initiator access with IB partition keys and target-side ACLs so that fabric membership alone does not grant initiator rights.
References
Related entries
- AMD Ryzen with AGESA microcode - FMA3 instruction sequence hang: A long series of FMA3 instructions hangs the systemCVE-2017-7262 · AMD Ryzen with AGESA microcode - FMA3 instruction sequence hangMedium
- Intel processors (speculative store bypass): Spectre v4: a load speculatively executes before an older storeCVE-2018-3639 · Intel processors (speculative store bypass)Medium
- Intel SGX Platform Software for Linux (AESM daemon): A local attacker can disable the AESM daemonCVE-2018-3689 · Intel SGX Platform Software for Linux (AESM daemon)Medium
- Intel SGX driver for Linux: Insufficient input validation in the out-of-tree SGX Linux driver lets a localCVE-2019-0157 · Intel SGX driver for LinuxMedium
- Intel PTT / fTPM (ECDSA and ECSchnorr timing): The firmware TPM's signing operation leaks nonce information throughCVE-2019-11090 · Intel PTT / fTPM (ECDSA and ECSchnorr timing)Medium
- Linux bnxt_re RoCE driver (bnxt_re_create_srq memory leak): A tenant can exhaust host memory by repeatedly triggeringCVE-2019-19077 · Linux bnxt_re RoCE driver (bnxt_re_create_srq memory leak)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.