CVE-2022-50736

Vulnerability

In the Linux kernel's RDMA/siw driver, when an immediate work request is flushed while the Queue Pair (QP) is in ERROR state, the send queue element's opcode is not correctly set. This results in an undefined opcode value being used to index into an array that maps opcodes between the siw internal representation and the RDMA core representation for work completion generation. The out-of-bounds access was detected by KASAN as a 'global-out-of-bounds' bug during NFSoRDMA testing [1].

Exploitation

An unprivileged user can trigger this vulnerability by putting a QP into ERROR state and then issuing immediate work requests. Additionally, a malicious user with access to a memory-mapped completion queue (CQ) could write arbitrary values for status or opcode, similarly causing out-of-bounds access to the mapping arrays [2]. No special privileges are required beyond the ability to create and manipulate RDMA resources.

Impact

Successful exploitation could lead to memory corruption, information disclosure, or a system crash (denial of service). The out-of-bounds access may allow an attacker to read or write kernel memory beyond the intended arrays, potentially escalating privileges if combined with other techniques.

Mitigation

The vulnerability is fixed in Linux kernel stable releases. The fix was backported to multiple stable kernel branches as shown in the referenced commits [3]. Users should update their kernels to the latest patched versions. No workaround is available; the fix must be applied.