Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): A userspace DEVX consumer can issue a firmware command opcode

CVSS 7.8CVE-2023-53340Firmware, BMC & network fabriccurated

Impact

A userspace DEVX consumer can issue a firmware command opcode the driver does not track, and when that command fails the driver indexes its per-opcode failure-statistics array with the untracked opcode. The result is an out-of-bounds array access in shared driver state driven by a value the caller chose - memory corruption reachable from a tenant's RDMA device node, not just a crash.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* with DEVX enabled (rdma-core mlx5dv DEVX general command) can send arbitrary firmware command opcodes and make them fail on purpose. No host root needed; the only precondition is that the tenant is allowed to open the mlx5 RDMA device and use DEVX, which is exactly what a bare RDMA/GPUDirect tenant is given.

What to do

Update to a patched kernel on your stream. Interim: drop /dev/infiniband/* from tenant containers that do not need verbs, or block DEVX for tenants (do not grant the RDMA device to untrusted workloads) until the node is rebooted onto a fixed kernel.

References

https://git.kernel.org/stable/c/411e4d6caa7f7169192b8dacc8421ac4fd64a354 https://git.kernel.org/stable/c/d8b6f175235d7327b4e1b13216859e89496dfbd5 https://nvd.nist.gov/vuln/detail/CVE-2023-53340

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.