NVIDIA/Mellanox ConnectX driver (mlx5_ib UMR resource init/cleanup): A failed workqueue allocation during mkey-cache

CVSS 7.0CVE-2023-52851NVIDIA / GPU stackcurated

Impact

A failed workqueue allocation during mkey-cache init caused the UMR queue pair to be destroyed twice, giving a double free and a syzkaller-confirmed use-after-free in ib_destroy_qp_user. The UMR queue pair is the driver's own privileged channel for rewriting memory-key translation tables, so a freed-and-reused UMR QP is a control channel over every tenant's memory keys on that adapter.

Who can reach it

Local. Triggered on the mlx5_ib device initialisation path under memory pressure or interrupted allocation - reachable in practice by a tenant that can drive the node into allocation failure while the RDMA stack is initialising.

What to do

Kernel update removing the duplicate cleanup call in mlx5_ib_stage_post_ib_reg_umr_init(). No workaround.

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2ef422f063b74adcc4a4a9004b0a87bb55e0a836 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52851.json

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.