Linux kernel (drivers/infiniband/core): IWARP port-mapper netlink attributes were accepted as plain strings with no

Impact

IWARP port-mapper netlink attributes were accepted as plain strings with no guarantee of a NUL terminator, then handed to strcmp and %s. A crafted attribute makes the kernel read past the attribute into adjacent memory - kernel memory disclosure into log output and comparisons, or an oops. The CNA scored it as requiring no privileges.

Who can reach it

Requires the ability to send RDMA_NL_IWPM netlink messages, normally the host's iwpmd port-mapper daemon. Relevant on iWARP-capable nodes (irdma in iWARP mode, cxgb4, siw); a tenant with CAP_NET_ADMIN in a non-user-namespaced net namespace, or anything that can impersonate the port mapper, reaches it. Not reachable from the fabric.

What to do

Update to a stable kernel carrying fcd07d3b8ee7 (or 87111356d58d / abda65bdd130) and reboot. Interim: do not grant CAP_NET_ADMIN over the host netlink namespace to tenant workloads, and disable iWARP mode where the fabric does not require it.

References