CVE-2023-52851: IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF
In the Linux kernel, the following vulnerability has been resolved:
IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF
In the unlikely event that workqueue allocation fails and returns NULL in mlx5mkeycacheinit(), delete the call to mlx5rumrresourcecleanup() (which frees the QP) in mlx5ibstagepostibregumrinit(). This will avoid attempted double free of the same QP when mlx5ibadd() does its cleanup.
Resolves a splat:
Syzkaller reported a UAF in ibdestroyqpuser
workqueue: Failed to create a rescuer kthread for wq "mkeycache": -EINTR infiniband mlx50: mlx5mkeycacheinit:981:(pid 1642): failed to create work queue infiniband mlx50: mlx5ibstagepostibregumrinit:4075:(pid 1642): mr cache init failed -12 ================================================================== BUG: KASAN: slab-use-after-free in ibdestroyqpuser (drivers/infiniband/core/verbs.c:2073) Read of size 8 at addr ffff88810da310a8 by task reproupstream/1642
Call Trace: <TASK> kasanreport (mm/kasan/report.c:590) ibdestroyqpuser (drivers/infiniband/core/verbs.c:2073) mlx5rumrresourcecleanup (drivers/infiniband/hw/mlx5/umr.c:198) mlx5ibadd (drivers/infiniband/hw/mlx5/main.c:4178) mlx5rprobe (drivers/infiniband/hw/mlx5/main.c:4402) ... </TASK>
Allocated by task 1642: kmalloc (./include/linux/kasan.h:198 mm/slabcommon.c:1026 mm/slabcommon.c:1039) createqp (./include/linux/slab.h:603 ./include/linux/slab.h:720 ./include/rdma/ibverbs.h:2795 drivers/infiniband/core/verbs.c:1209) ibcreateqpkernel (drivers/infiniband/core/verbs.c:1347) mlx5rumrresourceinit (drivers/infiniband/hw/mlx5/umr.c:164) mlx5ibstagepostibregumrinit (drivers/infiniband/hw/mlx5/main.c:4070) mlx5ibadd (drivers/infiniband/hw/mlx5/main.c:4168) mlx5rprobe (drivers/infiniband/hw/mlx5/main.c:4402) ...
Freed by task 1642: kmemcachefree (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822) ibdestroyqpuser (drivers/infiniband/core/verbs.c:2112) mlx5rumrresourcecleanup (drivers/infiniband/hw/mlx5/umr.c:198) mlx5ibstagepostibregumrinit (drivers/infiniband/hw/mlx5/main.c:4076 drivers/infiniband/hw/mlx5/main.c:4065) mlx5ibadd (drivers/infiniband/hw/mlx5/main.c:4168) mlx5rprobe (drivers/infiniband/hw/mlx5/main.c:4402) ...
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52851?
The severity of CVE-2023-52851 is dependent on the context of exploitation, but it is classified as a vulnerability in the Linux kernel that could lead to double free and use-after-free scenarios.
How do I fix CVE-2023-52851?
To fix CVE-2023-52851, you should update your Linux kernel to a version that includes the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2023-52851?
CVE-2023-52851 affects the Linux kernel versions from 5.19 up to but not including 6.1.63, from 6.2 up to but not including 6.5.12, and from 6.6 up to but not including 6.6.2.
What type of vulnerability is CVE-2023-52851?
CVE-2023-52851 is a memory corruption vulnerability in the Linux kernel, specifically relating to error handling in the mlx5 driver.
Can CVE-2023-52851 be exploited remotely?
The exploitability of CVE-2023-52851 depends on the specific system configuration and environment, but it could potentially be exploited under certain conditions.