CVE-2024-40992 - RDMA/rxe: Fix responder length checking for UD request packets

Back Back to CVE browser

HIGH

RDMA/rxe: Fix responder length checking for UD request packets

Published Jul 12, 2024

7.5

HIGH

CVSS 3.1

EPSS 0.61%

Description

According to the IBA specification: If a UD request packet is detected with an invalid length, the request shall be an invalid request and it shall be silently dropped by the responder. The responder then waits for a new request packet.

commit 689c5421bfe0 ("RDMA/rxe: Fix incorrect responder length checking") defers responder length check for UD QPs in function `copy_data`. But it introduces a regression issue for UD QPs.

When the packet size is too large to fit in the receive buffer. `copy_data` will return error code -EINVAL. Then `send_data_in` will return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into ERROR state.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  6.2
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <6.2
- Version
  6.10
  Status
  unaffected
  Constraints
  <=*
- Version
  6.6.36
  Status
  unaffected
  Constraints
  <=6.6.*
- Version
  6.9.7
  Status
  unaffected
  Constraints
  <=6.9.*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
6.2	affected	-
0	unaffected	<6.2
6.10	unaffected	<=*
6.6.36	unaffected	<=6.6.*
6.9.7	unaffected	<=6.9.*

Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Out of support scope
Red Hat Enterprise Linux 7

kernel-rt

Out of support scope
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel

Fix deferred
Red Hat Enterprise Linux 9

kernel-rt

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Out of support scope	n/a
Red Hat Enterprise Linux 7	kernel-rt	Out of support scope	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel-rt	Fix deferred	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (9)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2024-40992		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2297576		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38787		Advisory
https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341		Patch
https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996		Patch
https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636		Patch
https://lore.kernel.org/linux-cve-announce/2024071250-CVE-2024-40992-6554@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-40992
https://www.cve.org/CVERecord?id=CVE-2024-40992