CVE-2022-50543

A double-free vulnerability was found in the Linux kernel RDMA RXE (soft-RoCE) driver's memory region handling. A local user with access to RDMA userspace verbs can register a memory region with parameters that cause initialization to fail, triggering error handling code that frees the mr->map structure twice, which leads to memory corruption and can result in denial of service via kernel crash or potentially privilege escalation through heap manipulation.

The issue arises because of incorrect error handling in the memory region registration path. When rxe_reg_user_mr() calls rxe_mr_init_user() and initialization fails, the error path frees the mr->map structure. However, the cleanup then calls rxe_mr_cleanup() through __rxe_cleanup(), which attempts to free mr->map again, resulting in a double-free. This vulnerability was introduced when a previous fix for duplicate mapping tables was reverted, inadvertently reintroducing the double-free condition. Under normal circumstances, a local user with permissions to use RDMA verbs (typically requiring membership in the rdma group or CAP_IPC_LOCK capability) can trigger this by registering user memory regions with specific parameters that cause initialization failure. Double-free vulnerabilities are well-known memory corruption primitives; while direct exploitation for privilege escalation requires understanding kernel heap layout, they provide attackers with a foundation for more sophisticated attacks beyond simple denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the rdma_rxe module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.