CVE-2023-53528

Vulnerability

In the Linux kernel's RDMA/rxe driver, a flaw exists in the drain work queue code. When create_qp does not fully succeed, the cleanup code may attempt to drain the send or receive work queues before they have been properly initialized, leading to a null-pointer dereference and a segmentation fault. [1][2][3]

Exploitation

An attacker who can trigger a partial failure in a QP creation operation on a system using the rxe driver can cause the kernel to access uninitialized queue pointers. This condition occurs without requiring special privileges beyond the ability to create RDMA queue pairs. No authentication is needed if the attacker can interact with the RDMA subsystem.

Impact

A successful exploit causes a kernel crash (segmentation fault), resulting in a denial of service (DoS). The system becomes unstable and may require a reboot to restore normal operation.

Mitigation

The fix introduces a check for the existence of the work queues before attempting to drain them. Patches have been applied to the stable kernel branches. [1][2][3] Users should update to a kernel containing the commit or apply the referenced patch.