GPU VulnDB

Database/Firmware, BMC & network fabric

Linux kernel (drivers/infiniband/hw/hfi1): An off-by-one in the SDMA descriptor accounting lets the descriptor array in

CVSS 7.8CVE-2024-26766Firmware, BMC & network fabriccurated

Impact

An off-by-one in the SDMA descriptor accounting lets the descriptor array in a transmit request overflow, overwriting the neighbouring fields of the request structure - upstream shows a corrupted header pointer and a general protection fault. A tenant sending ordinary traffic thus corrupts kernel memory and can take the node down or steer a kernel pointer.

Who can reach it

Local and unprivileged: reproducible from the sendmsg syscall over an IPoIB interface backed by hfi1, per the upstream report. Any tenant that can send on an Omni-Path / hfi1 IPoIB interface reaches it; no fabric peer or privileged device node is required. Conditional on hfi1 hardware being present and in use for the data path.

What to do

Update to 4.19.308 / 5.4.270 / 5.10.211 / 5.15.150 / 6.1.80 / 6.3 or later. Interim: if hfi1 is not the production fabric on a node, blacklist the hfi1 module; otherwise drain untrusted tenants from Omni-Path nodes until patched.

References

https://git.kernel.org/stable/c/115b7f3bc1dce590a6851a2dcf23dc1100c49790https://git.kernel.org/stable/c/5833024a9856f454a964a198c63a57e59e07baf5https://nvd.nist.gov/vuln/detail/CVE-2024-26766

Related entries

All Firmware, BMC & network fabric entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.