CVE-2022-50736

A flaw was identified in the Linux kernel RDMA (siw) implementation where an undefined opcode value could be used during immediate work request flushing while in an error state. The send queue element opcode was not correctly set, which could lead to an out-of-bounds access when mapping between the SoftiWARP internal representation and the RDMA core representation in work completion generation. On some test configurations (e.g., NFSoRDMA testing), this resulted in a KASAN BUG report of type global-out-of-bounds. Additionally, a malicious local user with access to a memory-mapped completion queue (CQ) could supply undefined values for completion queue element status or opcode, leading to similar out-of-bounds array access.

This vulnerability is rated as Moderate because the SoftiWARP (siw) driver is not loaded by default on standard Red Hat Enterprise Linux deployments and requires explicit configuration. Exploitation is constrained to systems actively utilizing software-based RDMA over TCP/IP, where a local user with memory-mapped completion queue privileges or an invalid queue pair state can trigger out-of-bounds kernel memory reads. Consequently, the primary operational risk is limited to denial of service through kernel crashes on specialized RDMA-enabled nodes rather than widespread unauthorized access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the siw kernel module from loading. Create a file named /etc/modprobe.d/disable-siw.conf with the following content:

install siw /bin/true

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This mitigation may impact functionality that relies on the Shared-memory InfiniBand Work (siw) component.