RDMA/siw: Fix immediate work request flush to completion queue (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.19 % · centile 9 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Deferred
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix immediate work request flush to completion queue Correctly set send queue element opcode during immediate work request flushing in post sendqueue operation, if the QP is in ERROR state. An undefined ocode value results in out-of-bounds access to an array for mapping the opcode between siw internal and RDMA core representation in work completion generation. It resulted in a KASAN BUG report of type 'global-out-of-bounds' during NFSoRDMA testing. This patch further fixes a potential case of a malicious user which may write undefined values for completion queue elements status or opcode, if the CQ is memory mapped to user land. It avoids the same out-of-bounds access to arrays for status and opcode mapping as described above.
Références
- https://git.kernel.org/stable/c/6af043089d3f1210776d19b6fdabea610d4c7699
- https://git.kernel.org/stable/c/75af03fdf35acf15a3977f7115f6b8d10dff4bc7
- https://git.kernel.org/stable/c/f8d8fbd3b6d6cc3f25790cca5cffe8ded512fef6
- https://git.kernel.org/stable/c/355d2eca68c10d713a42f68e62044b3d1c300471
- https://git.kernel.org/stable/c/f3d26a8589dfdeff328779b511f71fb90b10005e
- https://git.kernel.org/stable/c/bdf1da5df9da680589a7f74448dd0a94dd3e1446
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | Linux |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2022-55753
- GCVE · GCVE-0-2022-50736
Avis du CERT-FR
- CERTFR-2026-AVI-0225 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0170 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0128 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0108 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b < 6af043089d3f1210776d19b6fdabea610d4c7699 ; affected 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b < 75af03fdf35acf15a3977f7115f6b8d10dff4bc7 ; affected 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b < f8d8fbd3b6d6cc3f25790cca5cffe8ded512fef6 ; affected 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b < 355d2eca68c10d713a42f68e62044b3d1c300471 ; affected 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b < f3d26a8589dfdeff328779b511f71fb90b10005e ; affected 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b < bdf1da5df9da680589a7f74448dd0a94dd3e1446 |
| Linux · Linux | affected 5.3 ; unaffected 0 < 5.3 ; unaffected 5.4.229 ≤ 5.4.* ; unaffected 5.10.163 ≤ 5.10.* ; unaffected 5.15.86 ≤ 5.15.* ; unaffected 6.0.16 ≤ 6.0.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |