REDHAT-BUG-2528646: Use After Free
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix responder UAF on IBQPMAXDESTRDATOMIC modifyqp
rxeqpfromattr() handles IBQPMAXDESTRDATOMIC outside the IBQPSTATE path, so it holds no statelock and runs while the responder task rxereceiver() (recvtask on rxewq) is live. A modifyqp() setting only that attribute calls freerdatomicresources() then allocrdatomicresources(), swapping qp->resp.resources[] while rxeprepareres()/findresource() walk it; freerdatomicresources() also leaves the cached pointer qp->resp.res dangling. A local unprivileged user can race the free/realloc into a use-after-free in rxereceiver() (local DoS).
Drain recvtask around the swap with rxedisabletask()/rxeenabletask(), as rxeqpreset() already does when tearing this array down, re-enabling only after allocrdatomicresources() succeeds so the responder never resumes against a NULL qp->resp.resources on the ENOMEM path. Also clear qp->resp.res in freerdatomicresources(), like the rxeresp.c completion paths.
Reproduced under KASAN; the slab-use-after-free in rxereceiver() is gone.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the RDMA/rxe IB_QP_MAX_DEST_RD_ATOMIC modify_qp path, drain and disable the recv_task around the resp.resources[] swap using rxe_disable_task(), and re-enable it with rxe_enable_task() only after alloc_rd_atomic_resources() succeeds; keep qp->resp.res synchronized with the replaced resources array.
Event History
Frequently Asked Questions
What access and conditions are required to trigger this issue?
A local unprivileged user must be able to race a queue-pair modification that changes IB_QP_MAX_DEST_RD_ATOMIC while the RXE responder task is active. The race occurs during replacement of responder RD atomic resources.
What is the practical impact of successful exploitation?
Successful exploitation can cause a use-after-free in rxe_receiver(), resulting in a local denial of service. The issue was reproduced under KASAN as a slab use-after-free.