Linux kernel (drivers/infiniband/sw/rxe): Soft-RoCE queue-pair cleanup drains send and receive work queues that a

CVE-2023-53528Firmware, BMC & network fabriccurated

Impact

Soft-RoCE queue-pair cleanup drains send and receive work queues that a partially failed create-QP never allocated, faulting in the kernel. Same shape as the other rxe unwind bug: a tenant that can make create-QP fail gets a reliable node crash, so one container can reboot a box full of other tenants' jobs.

Who can reach it

Local and unprivileged: reached from /dev/infiniband/uverbs* on an rdma_rxe (soft-RoCE) device by issuing a create-QP that fails after partial setup. No hardware adapter, no fabric peer. Conditional on rdma_rxe being loaded.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the drain-queue guard (commits da572f6313ae / d366642b3099). Interim: blacklist rdma_rxe where soft-RoCE is not needed, and remove /dev/infiniband from tenant containers.

References

https://git.kernel.org/stable/c/da572f6313aeead1f79e0810666bd8d8ffc794d4 https://git.kernel.org/stable/c/d366642b3099bd322375f5b71ba84ab1d586cd6d https://nvd.nist.gov/vuln/detail/CVE-2023-53528

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.