Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using the allocated buffer as struct ib_uverbs_send_wr. If a user provides a small wqe_size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge, and other fields will read beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to userspace. Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory allocation path, as reported by syzkaller. This is inconsistent with ib_uverbs_unmarshall_recv() which properly validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before proceeding. Add the same validation for ib_uverbs_post_send() to ensure wqe_size is at least sizeof(struct ib_uverbs_send_wr).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c3bea3d2dc5358e05541527283279102383b0231 to < 9c15ec4cd4e7f57c6bbcb4e73e99290f150dd2a7affectedc3bea3d2dc5358e05541527283279102383b0231 to < 9b5ac1c15334d46c0dbd49d64a2257b929500163affectedc3bea3d2dc5358e05541527283279102383b0231 to < 01c9b152647dc70dc06a4a2eff86ebb3b3c76075affectedc3bea3d2dc5358e05541527283279102383b0231 to < bf1feed1a7886af945f92890493aefd2b5c9928aaffectedc3bea3d2dc5358e05541527283279102383b0231 to < d533425ac1f2925b4fc3e4ed9b9d72362cb23475affectedc3bea3d2dc5358e05541527283279102383b0231 to < bf4454da8b1e712714628c0a0d6e7845bb40790aaffectedc3bea3d2dc5358e05541527283279102383b0231 to < bef70ff9841990658610512b4a18e4a88c9b4df6affectedc3bea3d2dc5358e05541527283279102383b0231 to < 1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0affected
Linux Linux
Default version status: affected
5.0affected0 to < 5.0unaffected5.10.252 to ≤ 5.10.*unaffected5.15.202 to ≤ 5.15.*unaffected6.1.165 to ≤ 6.1.*unaffected6.6.128 to ≤ 6.6.*unaffected6.12.75 to ≤ 6.12.*unaffected6.18.14 to ≤ 6.18.*unaffected6.19.4 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/9c15ec4cd4e7f57c6bbcb4e73e99290f150dd2a7 ↗
- https://git.kernel.org/stable/c/9b5ac1c15334d46c0dbd49d64a2257b929500163 ↗
- https://git.kernel.org/stable/c/01c9b152647dc70dc06a4a2eff86ebb3b3c76075 ↗
- https://git.kernel.org/stable/c/bf1feed1a7886af945f92890493aefd2b5c9928a ↗
- https://git.kernel.org/stable/c/d533425ac1f2925b4fc3e4ed9b9d72362cb23475 ↗
- https://git.kernel.org/stable/c/bf4454da8b1e712714628c0a0d6e7845bb40790a ↗
- https://git.kernel.org/stable/c/bef70ff9841990658610512b4a18e4a88c9b4df6 ↗
- https://git.kernel.org/stable/c/1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0 ↗