Linux kernel (drivers/infiniband/ulp/rtrs): The RTRS server trusts a connecting client to send its session-info message

CVSS 7.5CVE-2024-50062Firmware, BMC & network fabriccurated

Impact

The RTRS server trusts a connecting client to send its session-info message only after every connection of the path is up and the path is CONNECTED. A client that sends it early walks the server into a NULL dereference, so any host on the fabric can panic a storage-serving node and take out every tenant it serves.

Who can reach it

Pre-authentication and remote: the info_req exchange is part of RTRS path establishment, so a peer that can reach the server's RDMA listener drives it with a malformed connection sequence. Conditional on rtrs-srv being loaded and listening (RNBD storage backend). No tenant device node required - this is fabric-side.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the path-establishment sanity checks (commits 394b2f4d5e01 / b5d407666446). Interim: firewall or fabric-ACL the RTRS server port so only trusted initiators can reach it, or stop exporting RTRS targets from shared nodes.

References

https://git.kernel.org/stable/c/394b2f4d5e014820455af3eb5859eb328eaafcfd https://git.kernel.org/stable/c/b5d4076664465487a9a3d226756995b12fb73d71 https://nvd.nist.gov/vuln/detail/CVE-2024-50062

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.