CVE-2023-54048

Vulnerability

In the Linux kernel's bnxt_re RDMA driver, a race condition exists between queue pair (QP) destruction and completion handling. The hardware may generate completions indicating that a QP is destroyed, but the driver continues to schedule completion handlers for that QP after destruction. Since completion queues (CQs) remain active during QP destroy, a scenario arises where destroy_cq and poll_cq run simultaneously, leading to a use-after-free when poll_cq accesses a freed CQ [1].

Exploitation

An attacker with local access and the ability to trigger driver load/unload cycles (e.g., via module insertion/removal) can exploit this race. The vulnerability is triggered during normal operation when the driver is repeatedly loaded and unloaded, as shown by the kernel panic call trace in the description. No special privileges beyond the ability to interact with the RDMA subsystem are required; the race occurs during legitimate administrative actions.

Impact

Successful exploitation results in a kernel panic (denial of service), as evidenced by the reported crash. The panic occurs when bnxt_re_poll_cq is called after the CQ has been freed, causing an invalid memory access. This can lead to system instability or downtime. There is no indication of privilege escalation or data leakage.

Mitigation

The fix, committed to the Linux kernel stable tree, ensures that all completion handlers are completed before returning from the destroy QP operation. If free_cq is called soon after destroy_qp, the InfiniBand stack cancels the CQ work before invoking the destroy CQ verb, preventing the race [1][2]. Users should apply the latest kernel updates containing this patch.