CVE-2022-50666

Vulnerability

Description

In the Linux kernel's RDMA/siw driver, the QP (Queue Pair) destroy operation in siw_qp_destroy() does not ensure that all siw references to the QP are dropped before completing. The RDMA core frees the QP structure immediately after a successful return from siw_qp_destroy(), so siw must not hold any remaining references. However, due to this missing synchronization, a use-after-free can occur.

Exploitation

Scenario

The vulnerability was discovered during xfstest generic/460, which tests with NFSoRDMA [1]. The trigger involves a TCP connection drop by a peer, which causes the siw_cm_work_handler to be scheduled and executed after the QP has already been destroyed and freed. The delayed work handler then accesses the freed QP structure, leading to a use-after-free condition.

Impact

An attacker who can cause a TCP connection drop (e.g., by closing a network connection or inducing a network failure) may trigger this race condition. Successful exploitation could result in a kernel crash (denial of service) or potentially, though not confirmed in the description, arbitrary code execution due to the use-after-free. The attack surface.

Mitigation

The fix is included in the Linux kernel stable tree commit referenced [1]. The patch ensures that QP destroy waits for all siw references to be released before returning, preventing the race condition. Users should apply the latest stable kernel updates that contain this commit.