Linux kernel (drivers/infiniband/ulp/rtrs): The RTRS server builds an RDMA work request around a scatter-gather list

CVSS 9.8CVE-2024-36476Firmware, BMC & network fabriccurated

Impact

The RTRS server builds an RDMA work request around a scatter-gather list whose storage has already gone out of scope, so the transport copies data through a dangling descriptor. Upstream saw it as a kernel NULL-pointer fault inside the memory-copy path on the server - a remote client can crash the storage-serving node, and the underlying stale descriptor is a corruption primitive, not just a panic.

Who can reach it

Server-side and driven by the fabric: a client that establishes an RTRS/RNBD session and issues I/O drives the affected path on the target node, before any application-level trust decision. Conditional on the rtrs-srv module being loaded and exporting block devices (RNBD storage backend); the reported trace runs over soft-RoCE (rdma_rxe), which makes it reachable without special hardware.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the ib_sge scope fix (commits 7eaa71f56a6f / 143378075904). Interim: stop exporting RNBD/RTRS targets from shared nodes, or restrict which fabric addresses may open RTRS sessions.

References

https://git.kernel.org/stable/c/7eaa71f56a6f7ab87957213472dc6d4055862722 https://git.kernel.org/stable/c/143378075904e78b3b2a810099bcc3b3d82d762f https://nvd.nist.gov/vuln/detail/CVE-2024-36476

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.