In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/rxe: Validate num_sge\/cur_sge before indexing wqe->dma.sge[]<\/p>\n
For a user QP, qp->sq.queue is a ring the application writes directly,
\nso rxe_post_send() takes the is_user branch and only schedules send_task
\nwithout validating the WQE. rxe_requester() consumes it in place via
\nreq_next_wqe() and calls copy_data(), which indexes
\n&wqe->dma.sge[cur_sge] with the attacker-controlled num_sge\/cur_sge.
\nOnly the kernel path bounds num_sge (validate_send_wr()); the user WQE
\nis never checked, so a local unprivileged user can post a WQE with an
\nout-of-range cur_sge or oversized num_sge and force an out-of-bounds
\nread of the per-WQE sge array in copy_data() (vmalloc OOB read, local
\nDoS).<\/p>\n
Bound num_sge to qp->sq.max_sge in rxe_requester() before use, the way
\nget_srq_wqe() already guards SRQ entries, and bound cur_sge only when
\nthe WQE carries payload (dma.resid): copy_data() returns early on a
\nzero-length copy before touching dma->sge[], so a zero-payload WQE —
\nthe only kind a max_sge == 0 QP can post — stays valid.<\/p>\n
Reproduced under KASAN; the vmalloc-out-of-bounds in copy_data() is gone.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/rxe: Validate num_sge\/cur_sge before indexing wqe->dma.sge[]<\/p>\n
For a user QP, qp->sq.queue is a ring the application writes dir<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25894","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25894","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25894"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25894"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25894"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}