Linux kernel InfiniBand core (ib_uverbs post_send): ib_uverbs_post_send() takes the work-queue-entry size straight

Impact

ib_uverbs_post_send() takes the work-queue-entry size straight from userspace with no validation, allocates that size, then reads fields past the allocation - an out-of-bounds read of the kernel heap that leaks kernel memory to an unprivileged process. The receive path validated this; the send path did not. Any tenant process holding an RDMA verbs handle - which on a GPU cluster is every job using NCCL, UCX or MPI - can read host kernel memory.

Who can reach it

A local unprivileged user with an open RDMA verbs device handle. On a shared GPU node that is any tenant running a distributed training job.

What to do

Upgrade the host kernel to 7.0 or a stable backport (5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, 6.19.4). Rolling reboot of every node that exposes /dev/infiniband/uverbs* to workloads - which is all of them on an RDMA cluster.

References