Linux kernel (drivers/infiniband/sw/siw): A tenant gets an out-of-bounds kernel array read using values it controls.

Impact

A tenant gets an out-of-bounds kernel array read using values it controls. The driver translates completion opcode and status fields through fixed lookup tables without validating them, and those fields sit in a completion queue that is mapped into the tenant's own address space - so the tenant writes the index the kernel then trusts. Usable for kernel memory disclosure or to crash the node.

Who can reach it

Tenant container holding /dev/infiniband/uverbs* on a node with the soft-iWARP driver (siw) loaded. Two ways in: write garbage opcode/status into the mmap'd CQ entries, or push the QP into ERROR state and post work so the flush path builds a completion with an undefined opcode. A fabric peer can force the ERROR state by dropping the connection, so the second path is partly remote-driven.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: unload/blacklist siw where soft-iWARP is not required, and do not expose /dev/infiniband/* to containers that only need ordinary TCP networking.

References