Executive brief
The Linux kernel's RDMA/siw (Software iWarp) module handles remote direct memory access over Ethernet, used in high-performance networking and storage systems like NFSoRDMA. A flaw in work request processing allows undefined opcode or status values to cause out-of-bounds memory access when mapping completion queue events, potentially leading to kernel crashes or information disclosure.
Technical details
The vulnerability is a missing bounds check in the RDMA/siw completion queue handler (siw_reap_cqe) and send queue flush logic. When a queue pair enters ERROR state or when a malicious user writes invalid opcode/status values to a user-space-mapped completion queue, the code directly indexes global arrays (map_wc_opcode and map_cqe_status) with unchecked user-controlled values, causing out-of-bounds access. The attack requires local access to the completion queue memory mapping or triggering the flush path with a QP in ERROR state. The fix adds bounds checking and sanitization of opcode and status values before array indexing. A patch was available as of 2022-11-07.
Affected products
- Linux Linux kernel Multiple versions prior to patch (2022-11-07)
Timeline
- 2025-12-24: disclosed
- 2022-11-07: patched: Patch commit bdf1da5df9da680589a7f74448dd0a94dd3e1446