Linux kernel (drivers/infiniband/sw/siw): When soft-iWARP fails to process an inbound MPA connection request

CVSS 7.5CVE-2023-52513Firmware, BMC & network fabriccurated

Impact

When soft-iWARP fails to process an inbound MPA connection request immediately, the half-built endpoint unlinks its listener but the later socket-close path still dereferences it, crashing the node on a NULL listener. A peer that opens and breaks connections against a siw listener panics the host and takes out every tenant on it.

Who can reach it

Pre-authentication and remote: MPA request handling is the very first stage of iWARP connection setup, so any host on the IP fabric that can reach a siw listening endpoint drives it. Conditional on the siw (soft-iWARP) module being loaded and a listener bound - common where software RDMA is used for testing or for NVMe-oF/iSER over plain Ethernet.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the siw connection-failure fix (commits 6e26812e289b / 0d520cdb0cd0). Interim: blacklist the siw module where soft-iWARP is not required, or firewall the iWARP listener ports to trusted peers only.

References

https://git.kernel.org/stable/c/6e26812e289b374c17677d238164a5a8f5770594 https://git.kernel.org/stable/c/0d520cdb0cd095eac5d00078dfd318408c9b5eed https://nvd.nist.gov/vuln/detail/CVE-2023-52513

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.