CVE-2024-42145: IB/core: Implement a limit on UMAD receive List
In the Linux kernel, the following vulnerability has been resolved:
IB/core: Implement a limit on UMAD receive List
The existing behavior of ibumad, which maintains received MAD packets in an unbounded list, poses a risk of uncontrolled growth. As user-space applications extract packets from this list, the rate of extraction may not match the rate of incoming packets, leading to potential list overflow.
To address this, we introduce a limit to the size of the list. After considering typical scenarios, such as OpenSM processing, which can handle approximately 100k packets per second, and the 1-second retry timeout for most packets, we set the list size limit to 200k. Packets received beyond this limit are dropped, assuming they are likely timed out by the time they are handled by user-space.
Notably, packets queued on the receive list due to reasons like timed-out sends are preserved even when the list is full.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Set/implement a limit on the ib_umad UMAD receive list size to 200k; when packets are received beyond this limit, drop them (packets that were queued due to timed-out sends are preserved even when the list is full).
Linux kernel ib_umad (UMAD receive list) UMAD receive list size limit = 200k
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42145?
CVE-2024-42145 has been classified with a high severity due to the risk of uncontrolled growth in the UMAD receive list in the Linux kernel.
How do I fix CVE-2024-42145?
To fix CVE-2024-42145, upgrade to the patched versions of the Linux kernel specified in the advisory.
Which Linux kernel versions are affected by CVE-2024-42145?
CVE-2024-42145 affects multiple versions of the Linux kernel, specifically those prior to the specified patched versions.
What impact does CVE-2024-42145 have on my system?
CVE-2024-42145 can lead to potential denial of service as a result of excessive resource consumption.
Is there a workaround for CVE-2024-42145?
There are no known effective workarounds for CVE-2024-42145; upgrading is the recommended solution.