Executive brief
The Linux kernel's RDMA/mlx4 driver contains an integer overflow vulnerability in queue size handling. A local user can provide crafted input to cause undefined behavior through improper bit-shift operations, potentially leading to memory corruption or privilege escalation on systems using Mellanox RDMA hardware.
Technical details
The vulnerability is a shift wrapping (integer overflow) flaw in the set_user_sq_size() function of the RDMA/mlx4 driver (drivers/infiniband/hw/mlx4/qp.c). The ucmd->log_sq_bb_count parameter is controlled by userspace and used directly in a left-shift operation without overflow checking, allowing values that cause the shift to wrap and bypass sanity checks on maximum queue size. This occurs during queue pair creation, requiring local access to open RDMA devices. An attacker can exploit this to bypass size validation, potentially leading to out-of-bounds memory access. The fix applies check_shl_overflow() to detect and reject overflowing shift operations before they occur.
Affected products
- Linux Linux kernel multiple versions (see kernel.org stable branches)
Timeline
- 2023-03-07: disclosed
- 2023-05-11: patched