NVIDIA/Mellanox ConnectX driver (mlx5_ib on-demand paging MR creation): The xarray tracking implicit on-demand-paging
Impact
The xarray tracking implicit on-demand-paging children was not initialised when an ODP memory region was created, so deregistration walked an uninitialised structure and faulted on a wild address (the report shows a fault at 0x800000000 from ib_write_bw). ODP is the mechanism that lets the NIC page tenant memory in and out on demand; corrupt bookkeeping in that layer is bookkeeping about which pages belong to which memory key.
Who can reach it
Local, unprivileged. A tenant registers an ODP memory region and deregisters it - the ordinary lifecycle of any GPUDirect workload using on-demand paging.
What to do
Kernel update initialising the ODP xarray in reg_create(). Disabling ODP is possible on some stacks but costs the pinning-free memory model that large-model training relies on, so patching is the realistic route.
References
Related entries
- NVIDIA GPU Display Driver - kernel mode layer (Windows nvlddmkm.sys and Linux nvidia.ko): The DxgkDdiEscape handlerCVE-2022-28184 · NVIDIA GPU Display Driver - kernel mode layer (Windows nvlddmkm.sys and Linux nvidia.ko)High
- NVIDIA GPU Display Driver - Windows kernel mode layer (nvlddmkm.sys): An out-of-bounds read through DxgkDdiEscape leaksCVE-2022-31612 · NVIDIA GPU Display Driver - Windows kernel mode layer (nvlddmkm.sys)High
- NVIDIA GPU Display Driver - Windows kernel mode layer (nvlddmkm.sys): Any local user can null-pointer-dereferenceCVE-2022-31613 · NVIDIA GPU Display Driver - Windows kernel mode layer (nvlddmkm.sys)High
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): An out-of-bounds read in the kernel mode handler leaksCVE-2022-34676 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)High
- NVIDIA vGPU software - Virtual GPU Manager (host-side vGPU plugin / nvidia.ko): A second unvalidated index path in theCVE-2022-42262 · NVIDIA vGPU software - Virtual GPU Manager (host-side vGPU plugin / nvidia.ko)High
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): An integer overflow in the kernel mode handler leaksCVE-2022-42263 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.