Linux kernel (drivers/infiniband/sw/rxe): The soft-RoCE queue-pair init error path frees the send-queue ring and leaves

CVSS 7.8CVE-2021-47616Firmware, BMC & network fabriccurated

Impact

The soft-RoCE queue-pair init error path frees the send-queue ring and leaves the pointer dangling, so the final reference drop frees it a second time. A double free of an attacker-sized ring buffer is a strong heap-corruption primitive for escaping a container.

Who can reach it

An unprivileged process on a node with rdma_rxe loaded creates queue pairs whose initialisation fails after the send queue is allocated. No HCA, no fabric peer, no host root.

What to do

No fixed version is listed in the record - take the stable kernel carrying acb53e47db1f (or 84b01721e804) and reboot. Interim: unload and blacklist rdma_rxe on nodes that do not need soft-RoCE.

References

https://git.kernel.org/stable/c/acb53e47db1fbc7cd37ab10b46388f045a76e383 https://git.kernel.org/stable/c/84b01721e8042cdd1e8ffeb648844a09cd4213e0 https://nvd.nist.gov/vuln/detail/CVE-2021-47616

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.