Executive brief
A vulnerability was identified in the Linux kernel's RDMA (Remote Direct Memory Access) driver for NVIDIA/Mellanox network hardware. The issue involves an improper memory write operation when processing network data segments, which could lead to system instability or unauthorized memory access. This affects systems using high-performance networking hardware, potentially impacting data integrity and system availability.
Technical details
A vulnerability exists in the mlx5_ib driver within the Linux kernel's RDMA subsystem. The root cause is a field-spanning write in the set_eth_seg function in drivers/infiniband/hw/mlx5/wr.c, where a memcpy operation targeted a single field (eseg->inline_hdr.start) but intended to write across the subsequent data buffer. This triggered a FORTIFY_SOURCE warning and potential memory corruption. A local attacker with sufficient privileges to interact with RDMA interfaces could exploit this to cause a kernel panic or potentially escalate privileges. The fix involves correctly referencing the flexible array member 'data' instead of the 'start' field to satisfy compiler bounds checking.
Affected products
- Linux Linux Kernel 6.2.0-32-generic; fixed in various stable branches
Timeline
- 2024-01-28: patched: Initial patch submitted by Leon Romanovsky
- 2024-04-17: advisory: CVE-2024-26907 published in NVD
References
- https://git.kernel.org/stable/c/185fa07000e0a81d54cf8c05414cebff14469a5c
- https://git.kernel.org/stable/c/4d5e86a56615cc387d21c629f9af8fb0e958d350
- https://git.kernel.org/stable/c/60ba938a8bc8c90e724c75f98e932f9fb7ae1b9d
- https://git.kernel.org/stable/c/9a624a5f95733bac4648ecadb320ca83aa9c08fd
- https://git.kernel.org/stable/c/cad82f1671e41094acd3b9a60cd27d67a3c64a21
- https://git.kernel.org/stable/c/d27c48dc309da72c3b46351a1205d89687272baa
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html