Linux kernel - SRP target (srpt), drivers/infiniband/ulp/srpt/ib_srpt.c: TENANT ISOLATION: An integer overflow

Impact

TENANT ISOLATION: An integer overflow in the immediate-data length check on the SRP target lets a remote initiator bypass the bound and reach kernel memory it should not. The srpt target serves block storage over InfiniBand to compute clients, so a single tenant that can connect as an initiator gets kernel-level compromise of the storage node - and through it, access to every other tenant's volumes exported from the same target.

Who can reach it

A remote SRP initiator submits a command whose immediate data length is chosen so the length arithmetic wraps, defeating the check. Any host allowed to connect to the target can do it; on fabrics without per-tenant partitioning that is any host on the subnet.

What to do

Host reboot / kernel upgrade on SRP target nodes. Interim: enforce InfiniBand partitioning so only authorised initiators can reach the target port (SM config change, effective on the next sweep, no reload), and restrict target ACLs to known initiator GUIDs. Where SRP has been superseded by NVMe-oF, decommission the srpt target and unload the module - the cleanest fix.

References