Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/en_accel): All IPsec offload objects on a physical function share

Impact

All IPsec offload objects on a physical function share one DMA-mapped hardware context, and the driver drops the lock before the hardware has finished writing it. A second operation overwrites the buffer, so the first one reads another security association's state - the offloaded IPsec engine acts on cross-SA data (replay counters, lifetimes, soft/hard limits) where the fabric encryption terminates.

Who can reach it

Reachable wherever mlx5 IPsec crypto offload is enabled on the node. Concurrency is supplied by normal traffic across multiple SAs, so a peer on the encrypted fabric can time SA queries and updates against each other; a tenant that owns any IPsec SA on the shared PF contributes operations to the same context. Conditional on IPsec full/crypto offload being configured - not reachable if IPsec is done in software.

What to do

Update to a kernel carrying the fix on your stream. Interim: disable mlx5 IPsec crypto/full offload and terminate IPsec in software until nodes are rebooted onto a fixed kernel, especially where SAs belong to different tenants on the same physical function.

References