Linux kernel (drivers/infiniband/sw/rxe): A tenant gets a double free in the kernel heap through a failed memory

CVSS 7.8CVE-2022-50543Firmware, BMC & network fabriccurated

Impact

A tenant gets a double free in the kernel heap through a failed memory registration. When user MR setup fails, both the error path and the object cleanup release the same page-map allocation, giving the tenant a controllable allocator-corruption primitive rather than a simple crash.

Who can reach it

Tenant container holding /dev/infiniband/uverbs* on a node with soft-RoCE (rdma_rxe) loaded: call reg_mr with an address/length that makes the user-memory pinning fail, which the tenant chooses freely. Unprivileged and deterministic. Hardware HCAs do not use this code.

What to do

Update to a kernel carrying the fix (record cites 5.20-era mainline) or apply the listed stable commits. Interim: blacklist/unload rdma_rxe where soft-RoCE is not required, and remove /dev/infiniband/* from containers that do not use verbs.

References

https://git.kernel.org/stable/c/6ce577f09013206e36e674cd27da3707b2278268 https://git.kernel.org/stable/c/06f73568f553b5be6ba7f6fe274d333ea29fc46d https://nvd.nist.gov/vuln/detail/CVE-2022-50543

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.