Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): A userspace DEVX consumer can issue a firmware command opcode

Impact

A userspace DEVX consumer can issue a firmware command opcode the driver does not track, and when that command fails the driver indexes its per-opcode failure-statistics array with the untracked opcode. The result is an out-of-bounds array access in shared driver state driven by a value the caller chose - memory corruption reachable from a tenant's RDMA device node, not just a crash.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* with DEVX enabled (rdma-core mlx5dv DEVX general command) can send arbitrary firmware command opcodes and make them fail on purpose. No host root needed; the only precondition is that the tenant is allowed to open the mlx5 RDMA device and use DEVX, which is exactly what a bare RDMA/GPUDirect tenant is given.

What to do

Update to a patched kernel on your stream. Interim: drop /dev/infiniband/* from tenant containers that do not need verbs, or block DEVX for tenants (do not grant the RDMA device to untrusted workloads) until the node is rebooted onto a fixed kernel.

References