Linux kernel RDMA/siw: stale per-device net_device link leads to use-after-free on port query

CVSS 7.8CVE-2024-57857Kernel, userspace & hypervisorcurated

Impact

The soft-iWARP driver kept its own direct pointer to the net_device alongside the one ib_device already manages. The locally managed link was not kept in step with the netdev lifetime, and KASAN reported a slab use-after-free during siw_query_port(). On a GPU fleet this is the RDMA stack, so the blast radius is the fabric path: a crash or corruption in the driver that serves verbs queries takes down the node's RDMA traffic and with it any collective the node is part of. The practical exposure is narrow, though - siw is the software iWARP fallback, not the hardware path. Nodes using mlx5, irdma or another hardware provider do not load siw at all, and the module is absent on most datacenter images.

Who can reach it

Local. A process that can open an RDMA device and issue a port query (anyone holding /dev/infiniband/uverbs*) while the underlying network interface is being torn down. Only hosts that actually load the siw module are affected.

What to do

Take a stable kernel with commits 16b87037b488, 4eafeb4f021c or 6a97bfc0293d and reboot the node. If siw is not in use - the common case where RDMA runs on hardware providers - blacklisting or simply not loading the module removes the exposure without a reboot, and the kernel fix can wait for your normal cadence.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-57857 https://git.kernel.org/stable/c/16b87037b48889d21854c8e97aec8a1baf2642b3 https://git.kernel.org/stable/c/4eafeb4f021c50d13f199239d913b37de3c83135 https://git.kernel.org/stable/c/6a97bfc0293db234ac6ec32f6a32bd6702191a95

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.