Linux kernel - RDMA/siw (soft-iWARP), drivers/infiniband/sw/siw/siw_qp_rx.c: TENANT ISOLATION: siw places inbound Read

Impact

TENANT ISOLATION: siw places inbound Read Response segments at the sink buffer without checking the running total against the sink length on continuation segments - the sink is validated only on the first fragment and the cumulative length only on the last. A connected peer that answers an outstanding RDMA READ with segments that never set the DDP Last flag, carrying more payload than was requested, walks the write pointer past the validated buffer and writes attacker-controlled data out of bounds in the kernel. siw runs iWARP over ordinary routable TCP, so the attacker is simply the far end of an established connection and needs no local privilege on the victim. Remote kernel memory corruption with full confidentiality, integrity and availability loss - the worst-scored item in this slice.

Who can reach it

The attacker is the remote peer of an siw connection, reachable over normal TCP - which means anything the victim connects out to, including a storage target or a peer node in a job, can attack back. They respond to any RDMA READ the victim issues with a stream of Read Response segments with DDP Last clear and total length exceeding the RREAD length. No authentication is involved; the connection itself is the only prerequisite. Note siw is a software iWARP provider commonly loaded for testing, for nodes without an RNIC, and by blktests/nvme-over-fabrics setups - it is often present on GPU nodes that do not intend to use it.

What to do

Host reboot / kernel upgrade to a version carrying the fix (backported across stable trees) - no firmware, no switch work. Immediate zero-downtime mitigation: if you are not deliberately using soft-iWARP, blacklist and unload the module (rmmod siw; add to modprobe blacklist), which removes the attack surface entirely and costs nothing on the vast majority of GPU nodes. Audit with lsmod across the fleet - siw is frequently loaded by dependency rather than by intent. If siw is in use, treat the kernel upgrade as urgent and drain nodes in waves.

References