In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/siw: Reject MPA FPDU length underflow before signed receive math<\/p>\n
A malicious connected siw peer can send an iWARP FPDU whose MPA length
\nfield (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller
\nthan the fixed DDP\/RDMAP header for the announced opcode. Soft-iWARP
\nparses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode]
\n.hdr_len, but never compares mpa_len against that header length.<\/p>\n
siw_tcp_rx_data() then derives<\/p>\n
srx->fpdu_part_rem = be16_to_cpu(mpa_len) – fpdu_part_rcvd
\n + MPA_HDR_SIZE;<\/p>\n
where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this
\npoint. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest
\non-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below
\nhdr_len – MPA_HDR_SIZE underflows to a negative int.<\/p>\n
The signed value then flows into siw_proc_write()\/siw_proc_rresp() as<\/p>\n
bytes = min(srx->fpdu_part_rem, srx->skb_new);<\/p>\n
is handed to siw_check_mem() as an int len (whose interval check
\naddr + len > mem->va + mem->len is satisfied for a valid base when
\nlen is negative), and reaches siw_rx_data() -> siw_rx_kva() \/
\nsiw_rx_umem() -> skb_copy_bits() as a signed copy length. The header
\ncopy branch in skb_copy_bits() promotes that to size_t, producing a
\nmulti-gigabyte read.<\/p>\n
KASAN under a KUnit harness that drives the real kernel TCP receive
\npath — a loopback AF_INET socketpair, the malformed FPDU written via
\nkernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock
\ndispatching to siw_tcp_rx_data — reports:<\/p>\n
BUG: KASAN: use-after-free in skb_copy_bits+0x284\/0x480
\n Read of size 4294967295 at addr ffff888…
\n Call Trace:
\n skb_copy_bits
\n siw_rx_kva
\n siw_rx_data
\n siw_check_mem
\n siw_proc_write
\n siw_tcp_rx_data
\n __tcp_read_sock
\n siw_qp_llp_data_ready
\n tcp_data_ready
\n tcp_data_queue<\/p>\n
Add the missing invariant at the earliest point where the peer header
\nis fully assembled. iwarp_pktinfo[*].hdr_len – MPA_HDR_SIZE is exactly
\nthe value the siw transmitter uses as the minimum mpa_len for each
\nopcode (drivers\/infiniband\/sw\/siw\/siw_qp.c:33), so this matches the
\nprotocol contract. Out-of-range FPDUs terminate the connection with
\nTERM_ERROR_LAYER_LLP \/ LLP_ETYPE_MPA \/ LLP_ECODE_FPDU_START — which
\nis RFC 5044 Section 8 error code 3 (“Marker and ULPDU Length fields
\ndo not agree on the start of an FPDU”), the correct framing-error
\nclass for this inconsistency.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/siw: Reject MPA FPDU length underflow before signed receive math<\/p>\n
A malicious connected siw peer can send an iWARP FPDU whose <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15074","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15074","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15074"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15074"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15074"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}