Linux kernel RDMA core + mlx5_ib (ib_uverbs_ex_create_flow, flow steering rule creation): The port number a tenant

CVSS 6.5CVE-2021-47265Firmware, BMC & network fabriccurated

Impact

The port number a tenant supplies when creating an RDMA flow steering rule was never validated against the device's real port count before being handed to the driver. Flow steering is the mechanism that decides which packets land in which tenant's queue pair, so an unvalidated port index in the rule-creation path is both a kernel crash primitive (the mlx5_ib oops in the report) and a reason to distrust the boundary that is supposed to keep one tenant's traffic out of another's receive queues.

Who can reach it

Local ioctl on /dev/infiniband/uverbs* by any process allowed to create flow rules - which is any RDMA-capable tenant container. Unprivileged.

What to do

Kernel update moving port validation into the core create_flow handler. No configuration workaround; RDMA flow steering cannot be selectively disabled without breaking RoCE traffic classification.

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2adcb4c5a52a2623cd2b43efa7041e74d19f3a5e https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2021/CVE-2021-47265.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.