Executive brief
The Linux kernel's RDMA/RXE (software-based InfiniBand) driver has a flaw in its packet retry logic. When a network packet is dropped and must be resent, the driver fails to fully restore the internal state needed to process the data correctly. This causes retransmitted packets to become corrupted, leading to data integrity failures or communication failures in systems using InfiniBand over Ethernet for cluster computing or HPC workloads.
Technical details
The vulnerability exists in the rxe_requester() function within the RDMA/RXE driver (drivers/infiniband/sw/rxe/rxe_req.c). When rxe_xmit_packet() returns -EAGAIN (indicating the packet was dropped by the IP layer), the code attempts to restore the work queue element (wqe) state to retry transmission. However, the save_state() and rollback_state() routines incompletely save and restore the wqe's dma struct—a critical component used to track position in the scatter-gather element (SGE) table during packet processing. Because state is not saved before packet building (which modifies the dma struct), resent packets reference corrupted DMA tracking information. The fix adds explicit saving of wqe->dma before packet construction and restoration of wqe->dma during rollback. No authentication or special privileges are required; the vulnerability manifests under high-stress conditions with many queue pairs sending large messages over slow network links.
Affected products
- Linux Linux kernel 5.0 through at least 6.5
Timeline
- 2023-07-21: disclosed
- 2023-09-13: patched