In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
IB\/mad: Drop unmatched RMPP responses before reassembly<\/p>\n
Kernel-handled RMPP receive processing starts reassembly for active
\nDATA responses before the response is matched to an outstanding send.
\nThe normal match happens later, after ib_process_rmpp_recv_wc() has
\neither assembled a complete message or consumed the segment.<\/p>\n
That ordering lets an unsolicited response that routes to a kernel
\nRMPP agent by the high TID bits allocate or extend RMPP receive state
\nbefore the full TID and source address are checked against a real
\nrequest. A reordered burst can therefore reach the receive-side
\ninsertion path even though the response would not match any send.<\/p>\n
For kernel-handled RMPP DATA responses, require the existing
\nib_find_send_mad() match before entering RMPP reassembly. The matcher
\nalready checks the full TID, management class and source address\/GID
\nagainst the agent wait, backlog and in-flight send lists. If there is
\nno match, drop the response without creating RMPP state.<\/p>\n
This leaves the RMPP window behavior unchanged and only rejects
\nresponses that have no corresponding request.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
IB\/mad: Drop unmatched RMPP responses before reassembly<\/p>\n
Kernel-handled RMPP receive processing starts reassembly for active
\nDATA r<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5472","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5472","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5472"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5472"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5472"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}