Linux kernel (drivers/infiniband/hw/hfi1): User SDMA requests with multiple payload buffers are read past the declared

CVSS 7.8CVE-2023-52474Firmware, BMC & network fabriccurated

Impact

User SDMA requests with multiple payload buffers are read past the declared length of each buffer and the wrong pages are put on the wire, so data the sender never asked to transmit leaves the node. The same fix closes pin-cache races that produce duplicate page pinnings and a window where an entry is removed, the lock dropped, and new pages pinned - stale pinned-page state a tenant can steer.

Who can reach it

Local and unprivileged: a tenant with access to the hfi1 user device submits an SDMA request whose non-tail iovec does not end on a page boundary. No fabric peer or root is needed. Conditional on hfi1 (Omni-Path) hardware and the user SDMA path being exposed to tenants.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the multi-iovec SDMA and mmu_rb fixes (commits 9c4c6512d733 / a2bd706ab635). Interim: remove hfi1 user device nodes from tenant containers, or blacklist hfi1 on nodes where Omni-Path is not the production fabric.

References

https://git.kernel.org/stable/c/9c4c6512d7330b743c4ffd18bd999a86ca26db0d https://git.kernel.org/stable/c/a2bd706ab63509793b5cd5065e685b7ef5cba678 https://nvd.nist.gov/vuln/detail/CVE-2023-52474

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.