Linux kernel InfiniBand core (ib_umad): ib_umad kept received management datagrams on an unbounded list

Impact

ib_umad kept received management datagrams on an unbounded list. Any node on the fabric that sends MADs faster than userspace drains them exhausts host memory and takes the node down. This is a fabric-wide, unauthenticated availability attack against every host running a subnet manager, an IB diagnostic agent, or UFM's host-side collectors - one malicious or misbehaving endpoint degrades the management plane for the entire cluster.

Who can reach it

Any unauthenticated node attached to the InfiniBand subnet, sending a flood of management datagrams. No credentials anywhere.

What to do

Upgrade the host kernel to 6.10 or a stable backport (4.19.318, 5.4.280, 5.10.222, 5.15.163, 6.1.98, 6.6.39, 6.9.9) - the fix caps the list at 200k entries. Rolling reboot, prioritizing the nodes that run OpenSM/UFM agents. No firmware flash.

References

Related entries

• AMI AptioV BIOS (TOCTOU race condition): Firmware TOCTOU race allowing execution of arbitrary code on the target deviceCVE-2024-42444 · AMI AptioV BIOS (TOCTOU race condition)High
• AMI AptioV BIOS (TOCTOU race condition): Second firmware TOCTOU race reaching arbitrary code execution with scope changeCVE-2024-42446 · AMI AptioV BIOS (TOCTOU race condition)High
• GRUB2 (gettext / message catalogue): Integer overflow reading a crafted translation catalogue gives bothCVE-2024-45776 · GRUB2 (gettext / message catalogue)High
• GRUB2 (gettext / message catalogue): Second integer overflow in the same translation path, producing a heapCVE-2024-45777 · GRUB2 (gettext / message catalogue)High
• GRUB2 (HFS filesystem parser): An unbounded strcpy of the HFS volume name overflows a fixed bufferCVE-2024-45782 · GRUB2 (HFS filesystem parser)High
• Linux kernel (drivers/infiniband/ulp/rtrs): The RTRS server trusts a connecting client to send its session-info messageCVE-2024-50062 · Linux kernel (drivers/infiniband/ulp/rtrs)High