Executive Summary

This vulnerability exists in the Linux kernel's RDMA core, specifically in the handling of the cpu_id attribute supplied by user space through UVERBS_ATTR_ALLOC_DMAH_CPU_ID.

The issue is that the cpu_id value is passed directly to the function cpumask_test_cpu() without verifying if it is within the valid CPU range (less than nr_cpu_ids).

Because of this lack of validation, an out-of-bounds read can occur on the cpumask bitmap, which is indexed by cpu_id without proper bounds checking.

On kernels built with CONFIG_DEBUG_PER_CPU_MAPS, this can trigger a WARN_ON_ONCE() warning, and if panic_on_warn is enabled, it can cause the machine to reboot.

The fix involves rejecting any cpu_id values that are not smaller than nr_cpu_ids with an error code (-EINVAL) before they are used.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to an out-of-bounds read in kernel memory, which may cause undefined behavior or system instability.

On systems with CONFIG_DEBUG_PER_CPU_MAPS enabled and panic_on_warn set, supplying an invalid cpu_id can cause the kernel to trigger a warning that leads to a machine reboot.

Therefore, an attacker or untrusted user space process could potentially cause denial of service by forcing the system to reboot unexpectedly.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the issue is resolved.

The fix involves rejecting any cpu_id that is not smaller than nr_cpu_ids with -EINVAL before it is used, preventing out-of-bounds reads and potential system reboots.

If you are running kernels built with CONFIG_DEBUG_PER_CPU_MAPS and have panic_on_warn enabled, consider disabling panic_on_warn temporarily to avoid unexpected reboots until the kernel is updated.

Useful 0 Not Useful 0