Linux kernel (drivers/infiniband/core): The core set the send and receive completion-queue pointers on a queue pair

CVSS 7.8CVE-2021-47196Firmware, BMC & network fabriccurated

Impact

The core set the send and receive completion-queue pointers on a queue pair only after handing it to the driver, so when driver-side creation fails the destroy path walks unset pointers and writes into freed memory. The upstream report is a KASAN use-after-free reached from an ordinary userspace program on mlx5 - the exact NIC under most GPU clusters.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* issues an ibv_create_qp that the hardware driver rejects. Failing QP creation is trivially arranged with bad attributes or resource exhaustion, so this is a one-syscall reach from inside a container - no fabric peer, no host root.

What to do

No fixed version is listed in the record - take the stable kernel carrying b70e072feffa (or 6cd7397d01c4) and reboot. Interim: remove /dev/infiniband/* from untrusted containers.

References

https://git.kernel.org/stable/c/b70e072feffa0ba5c41a99b9524b9878dee7748e https://git.kernel.org/stable/c/6cd7397d01c4a3e09757840299e4f114f0aa5fa0 https://nvd.nist.gov/vuln/detail/CVE-2021-47196

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.