Linux kernel (drivers/infiniband/hw/irdma): Use-after-free on completion-queue teardown. The driver frees the CQ

CVSS 7.8CVE-2022-50137Firmware, BMC & network fabriccurated

Impact

Use-after-free on completion-queue teardown. The driver frees the CQ backing resources before it has stopped the interrupt path from processing completions against them, so an in-flight CQE lands in freed memory - a heap write primitive from an unprivileged tenant, not merely a crash.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an Intel E810 / irdma node destroys a CQ while traffic is still arriving on the associated QP. The race window is widened by inbound fabric traffic, so a cooperating peer on the RDMA fabric makes it far easier to win. Requires the irdma module and Intel RDMA-capable NICs.

What to do

No fixed release is published in this record - apply the listed stable fix commits or move to a current stable kernel. Interim: if tenants do not need RDMA, drop /dev/infiniband/* from their containers; if they do, treat irdma nodes as untrusted-tenant boundary hosts and prioritize the kernel update.

References

https://git.kernel.org/stable/c/92520864ef9f912f38b403d172a0ded020683d55 https://git.kernel.org/stable/c/0abf2eef80295923b819ce89ff9edc1fe61be17c https://nvd.nist.gov/vuln/detail/CVE-2022-50137

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.