CVE-2022-50671

Vulnerability

In the Linux kernel's RDMA/rxe driver, when rxe_queue_init fails during rxe_qp_init_req, the function rxe_qp_init_req does not initialize qp->req.task.func and qp->req.task.arg. This leaves these pointers uninitialized, causing a NULL pointer dereference when rxe_qp_do_cleanup is called during error handling of the failed QP creation [1].

Exploitation

An attacker with local access and the ability to trigger RDMA queue pair creation (e.g., via RDMA subsystem calls) could cause rxe_queue_init to fail, leading to the NULL pointer dereference. The vulnerability requires no special privileges beyond the ability to create queue pairs, and it is triggered during normal cleanup operations.

Impact

A successful exploit results in a kernel NULL pointer dereference, causing a system crash (denial of service). This could lead to a denial of service condition, as the kernel panics or hangs. There is no evidence of privilege escalation or remote exploitation.

Mitigation

The issue is resolved in Linux kernel stable releases with commits [1] and related backports. Users should update to the latest stable kernel version. No workaround is available, as the vulnerability is in the driver cleanup path.