Linux kernel (drivers/infiniband/sw/rxe): If soft-RoCE queue-pair creation fails partway, the unwind path runs cleanup

CVSS 5.5CVE-2023-54028Firmware, BMC & network fabriccurated

Impact

If soft-RoCE queue-pair creation fails partway, the unwind path runs cleanup on task state that was never initialized and oopses on an uninitialized spinlock. A tenant that submits a create-QP that is guaranteed to fail can panic the node at will - a repeatable noisy-neighbour outage for everyone sharing it.

Who can reach it

Local and unprivileged: a tenant holding /dev/infiniband/uverbs* on an rdma_rxe (soft-RoCE) device issues a create-QP with parameters that fail after partial initialization. No hardware adapter and no fabric peer needed - rxe runs over any Ethernet NIC. Conditional on the rdma_rxe module being loaded and an rxe device present.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the rxe cleanup-task fix (commits 3236221bb8e4 / c8473cd5b301). Interim: blacklist rdma_rxe on nodes that do not need soft-RoCE, and remove /dev/infiniband from tenant containers.

References

https://git.kernel.org/stable/c/3236221bb8e4de8e3d0c8385f634064fb26b8e38 https://git.kernel.org/stable/c/c8473cd5b301279a41dc75e5afb26b3d5223b6c7 https://nvd.nist.gov/vuln/detail/CVE-2023-54028

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.