Linux kernel mlx5: SKB leak during PTP FIFO resync exhausts memory on ConnectX NICs

CVSS 7.8CVE-2023-54238Firmware, BMC & network fabriccurated

Impact

The mlx5 Ethernet driver for ConnectX NICs leaks socket buffers during PTP timestamp FIFO resync, because popped SKBs were never consumed and the free-running counter room check was computed on a promoted int rather than u16. On a GPU node whose storage and east-west traffic ride ConnectX adapters with hardware timestamping enabled, the leak is unbounded over time and ends in memory pressure on the host - which costs a drain of the node rather than a quick service restart. There is no remote trigger described; the leak accrues from normal PTP operation.

Who can reach it

No authenticated attacker is described. The leak occurs during normal PTP timestamping operation on mlx5 interfaces; a local workload generating heavy timestamped traffic accelerates it.

What to do

Update to a stable kernel containing the mlx5 fifo fix (commits 234cffda95e1, 68504c66d08c, e435941b1da1) and reboot the node. No userspace mitigation is described; disabling PTP hardware timestamping on mlx5 interfaces avoids the resync path at the cost of losing hardware timestamps.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-54238 https://git.kernel.org/stable/c/234cffda95e1049f58e8ec136ef105c633f0ed19 https://git.kernel.org/stable/c/68504c66d08c70fb92799722e25a932d311d74fd https://git.kernel.org/stable/c/e435941b1da1a0be4ff8a7ae425774c76a5ac514

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.