Linux kernel (drivers/infiniband/sw/siw): Soft-iWARP memory-region allocation stores the memory object into the MR and

CVSS 7.8CVE-2021-47012Firmware, BMC & network fabriccurated

Impact

Soft-iWARP memory-region allocation stores the memory object into the MR and then frees it if ID allocation fails, leaving the MR pointing at freed memory that the error path immediately dereferences. A use-after-free on the memory-registration path, reachable without any RDMA hardware.

Who can reach it

An unprivileged process on a node with siw loaded registers memory regions until the ID allocator fails - a container can drive that with its own resource limits. No HCA, no fabric peer, no host root.

What to do

No fixed version is listed in the record - take the stable kernel carrying 30b9e92d0b5e (or 608a4b90ece0 / 3e22b88e02c1) and reboot. Interim: unload and blacklist siw where soft-iWARP is not required.

References

https://git.kernel.org/stable/c/30b9e92d0b5e5d5dc1101ab856c17009537cbca4 https://git.kernel.org/stable/c/608a4b90ece039940e9425ee2b39c8beff27e00c https://nvd.nist.gov/vuln/detail/CVE-2021-47012

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.