CVE-2023-54274

Vulnerability

Description

The Linux kernel's RDMA SRP target (srpt) module contains a NULL pointer dereference vulnerability in the MAD (Management Datagram) agent unregistration path. The srpt_unregister_mad_agent() function performs a non-null check on the mad_agent pointer before calling ib_unregister_mad_agent(). However, this check can incorrectly pass if the pointer holds an error value (e.g., an ERR_PTR) rather than a valid pointer. This race condition occurs when srpt_add_one() and srpt_remove_one() execute concurrently, leaving the mad_agent pointer in an error state for a short window [1][2].

Exploitation

Conditions

An attacker would need to trigger a race condition between the addition and removal of an SRPT device. This typically requires local access to the system and the ability to manipulate RDMA device state (e.g., via RoCE driver operations). The vulnerability manifests when a RoCE driver (such as bnxt_re) unregisters an ib_device while the srpt module is simultaneously initializing, leading to a call to srpt_remove_one() with an invalid mad_agent pointer. No special privileges beyond the ability to trigger device hotplug or driver reload are required.

Impact

Successful exploitation results in a kernel NULL pointer dereference, as shown in the stack trace where _raw_spin_lock_irqsave is called on a NULL pointer. This causes an immediate system crash (Oops) and denial of service. The vulnerability does not appear to allow arbitrary code execution or privilege escalation, but it can render the system unavailable.

Mitigation

The fix adds a proper valid pointer check using IS_ERR_OR_NULL() before unregistering the MAD agent. The patch has been backported to stable kernel trees as commits [1] and [2]. Users should update to a kernel version containing these commits. No workaround is available; the only mitigation is to apply the kernel patch.