CVE-2022-50736
RDMA/siw: Fix immediate work request flush to completion queue
Vexday Risk Score
3Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS —EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
24 dez 2025Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix immediate work request flush to completion queue
Correctly set send queue element opcode during immediate work request
flushing in post sendqueue operation, if the QP is in ERROR state.
An undefined ocode value results in out-of-bounds access to an array
for mapping the opcode between siw internal and RDMA core representation
in work completion generation. It resulted in a KASAN BUG report
of type 'global-out-of-bounds' during NFSoRDMA testing.
This patch further fixes a potential case of a malicious user which may
write undefined values for completion queue elements status or opcode,
if the CQ is memory mapped to user land. It avoids the same out-of-bounds
access to arrays for status and opcode mapping as described above.
Produtos afetados
Linux · LinuxReferências
https://git.kernel.org/stable/c/355d2eca68c10d713a42f68e62044b3d1c300471https://git.kernel.org/stable/c/6af043089d3f1210776d19b6fdabea610d4c7699https://git.kernel.org/stable/c/75af03fdf35acf15a3977f7115f6b8d10dff4bc7https://git.kernel.org/stable/c/bdf1da5df9da680589a7f74448dd0a94dd3e1446https://git.kernel.org/stable/c/f3d26a8589dfdeff328779b511f71fb90b10005ehttps://git.kernel.org/stable/c/f8d8fbd3b6d6cc3f25790cca5cffe8ded512fef6