CVE-2023-54168

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()

The ucmd->log_sq_bb_count variable is controlled by the user so this shift can wrap. Fix it by using check_shl_overflow() in the same way that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()").

A flaw was found in the Linux kernel RDMA mlx4 driver where a user-controlled log_sq_bb_count could trigger shift overflow/undefined behavior in set_user_sq_size(). This could bypass the intended send-queue size sanity check and lead to invalid queue sizing, potentially causing a kernel crash (DoS) and, in a worst-case scenario, kernel memory corruption. Exploitation requires local access to RDMA user verbs on systems with mlx4 hardware/support enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.