Linux kernel - RDMA/siw (soft-iWARP) MPA framing, drivers/infiniband/sw/siw/siw_qp_rx.c: TENANT ISOLATION: The siw

Impact

TENANT ISOLATION: The siw receive path decodes the MPA framed-PDU length from the wire and feeds it into signed arithmetic against the per-fragment remainder without rejecting an underflow first. A remote peer that sends a crafted FPDU length drives the subsequent length math negative, which downstream is used to size receive operations - the classic path to out-of-bounds kernel access from a network packet. Same reachability profile as the Read Response bug in the same file: remote, unauthenticated relative to the connection, over plain TCP, giving full compromise of the victim kernel.

Who can reach it

Any peer on an established siw connection sends an MPA FPDU whose declared length underflows the remaining fragment length. Because siw rides ordinary TCP, this is reachable from anything the node peers with, including across routed networks if the RDMA port is not firewalled. No local access and no credentials on the victim.

What to do

Host reboot / kernel upgrade. Same practical advice as the sibling siw bug: unload and blacklist the siw module wherever soft-iWARP is not deliberately in use - a config change with zero downtime that eliminates both findings at once. Where siw is required, upgrade the kernel and reboot on a rolling drain; also firewall the iWARP TCP ports to known peers as an interim control.

References