Linux kernel (drivers/infiniband/sw/siw): Soft-iWARP published a new queue pair into the lookup table before its

Impact

Soft-iWARP published a new queue pair into the lookup table before its queues, completion-queue pointers and state were set up, so a concurrent QP-number lookup reaches a half-built object and follows uninitialised pointers. An attacker who wins the window gets kernel memory corruption from unprivileged userspace.

Who can reach it

An unprivileged process on a node with the siw module loaded creates a QP in one thread while a second thread - or an inbound iWARP segment from a fabric peer that resolves the freshly allocated QP number - looks it up. No hardware RDMA adapter needed, which is exactly why siw is dangerous to leave loaded in tenant containers.

What to do

No fixed version is listed in the record - take the stable kernel carrying 3c9d12821996 (or 3ff82e3841ec / 36e91a58397c) and reboot. Interim: unload and blacklist siw on nodes that do not need soft-iWARP.

References