Linux kernel SRP target (ib_srpt, LIO port lifetime vs RDMA port lifetime): The SRP target's port structures were owned

CVSS 7.0CVE-2022-50129Firmware, BMC & network fabriccurated

Impact

The SRP target's port structures were owned by the RDMA core while the LIO target port data inside them was owned by the SCSI target subsystem, and the two lifetimes were not decoupled - KASAN caught a use-after-free in srpt_enable_tpg. This is on the target side of SCSI-over-RDMA, the process exporting block devices to the cluster, so a use-after-free during target reconfiguration lands in the daemon that mediates every initiator's access to those devices.

Who can reach it

Local on the storage target, racing RDMA port teardown against LIO target-portal-group configuration. Requires the ability to drive target configuration or to time an RDMA port event against it.

What to do

Kernel update decoupling srpt_port and srpt_port_id lifetimes. Operationally: do not reconfigure LIO target portal groups while RDMA ports are being brought up or down - sequence storage-target maintenance rather than overlapping it.

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=388326bb1c32fcd09371c1d494af71471ef3a04b https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2022/CVE-2022-50129.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.