Linux kernel (drivers/infiniband/core): The RDMA user-capability check identified the capability file only by device

Impact

The RDMA user-capability check identified the capability file only by device number, and character and block device numbers alias. A tenant that opens a block device with a colliding major/minor can pass that fd off as an authentic ucap file and be granted an RDMA user capability it was never issued - for example privileged mlx5 control or raw-QP access. The CNA scored it scope-changed, i.e. the privilege gained reaches beyond the caller's own container.

Who can reach it

A tenant container that holds /dev/infiniband/* and can open any block device node whose dev_t matches the ucap character device. Both are things a container with device access routinely has. No fabric peer and no host root needed.

What to do

Update to a stable kernel carrying 96b6e98ff12d (or aa181287ebdc / 4a1b1ac27446) and reboot. Interim: do not expose block device nodes and /dev/infiniband/* to the same untrusted container, and drop the RDMA ucap devices from tenant containers that do not need privileged verbs.

References