Linux kernel (drivers/infiniband/core): An unprivileged tenant corrupts RDMA connection-manager state and lands a

CVSS 7.8CVE-2022-48925Firmware, BMC & network fabriccurated

Impact

An unprivileged tenant corrupts RDMA connection-manager state and lands a use-after-free. An address-resolve call that should have been rejected outright still overwrites the source address of a listening connection id, which later makes cancellation walk a list it does not own - freed memory is read and linked into live kernel lists.

Who can reach it

Any process with /dev/infiniband/rdma_cm (ucma) inside a tenant container: put an id into LISTEN, then issue a resolve on the same id, then destroy it. Plain write() calls on the device, no capabilities and no cooperating peer required. Provider-independent, so soft-RoCE nodes are exposed too.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: drop /dev/infiniband/rdma_cm from tenant containers that do not need connection-manager access.

References

https://git.kernel.org/stable/c/5b1cef5798b4fd6e4fd5522e7b8a26248beeacaa https://git.kernel.org/stable/c/00265efbd3e5705038c9492a434fda8cf960c8a2 https://nvd.nist.gov/vuln/detail/CVE-2022-48925

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.