Linux kernel (drivers/infiniband/sw/siw): A tenant gets an out-of-bounds kernel array read using values it controls.

CVSS 7.1CVE-2022-50736Firmware, BMC & network fabriccurated

Impact

A tenant gets an out-of-bounds kernel array read using values it controls. The driver translates completion opcode and status fields through fixed lookup tables without validating them, and those fields sit in a completion queue that is mapped into the tenant's own address space - so the tenant writes the index the kernel then trusts. Usable for kernel memory disclosure or to crash the node.

Who can reach it

Tenant container holding /dev/infiniband/uverbs* on a node with the soft-iWARP driver (siw) loaded. Two ways in: write garbage opcode/status into the mmap'd CQ entries, or push the QP into ERROR state and post work so the flush path builds a completion with an undefined opcode. A fabric peer can force the ERROR state by dropping the connection, so the second path is partly remote-driven.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: unload/blacklist siw where soft-iWARP is not required, and do not expose /dev/infiniband/* to containers that only need ordinary TCP networking.

References

https://git.kernel.org/stable/c/6af043089d3f1210776d19b6fdabea610d4c7699 https://git.kernel.org/stable/c/75af03fdf35acf15a3977f7115f6b8d10dff4bc7 https://nvd.nist.gov/vuln/detail/CVE-2022-50736

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.