222 lines
12 KiB
JSON
222 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2022-50136",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-06-18T10:57:27.422Z",
|
|
"datePublished": "2025-06-18T11:03:00.289Z",
|
|
"dateUpdated": "2026-08-05T08:57:30.552Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T08:57:30.552Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event\n\nIf siw_recv_mpa_rr returns -EAGAIN, it means that the MPA reply hasn't\nbeen received completely, and should not report IW_CM_EVENT_CONNECT_REPLY\nin this case. This may trigger a call trace in iw_cm. A simple way to\ntrigger this:\n server: ib_send_lat\n client: ib_send_lat -R <server_ip>\n\nThe call trace looks like this:\n\n kernel BUG at drivers/infiniband/core/iwcm.c:894!\n invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n <...>\n Workqueue: iw_cm_wq cm_work_handler [iw_cm]\n Call Trace:\n <TASK>\n cm_work_handler+0x1dd/0x370 [iw_cm]\n process_one_work+0x1e2/0x3b0\n worker_thread+0x49/0x2e0\n ? rescuer_thread+0x370/0x370\n kthread+0xe5/0x110\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x1f/0x30\n </TASK>"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - The bug is triggered while processing an MPA CONNECT reply received over TCP from the remote iWARP peer on the active/client side of Soft-iWARP; a remote responder can deliver a partial then complete MPA reply to reach the vulnerable path.\nAC:L - A peer fully controls TCP segmentation of the MPA reply and can reliably force siw_recv_mpa_rr() to return -EAGAIN then complete; the fix commit also documents a simple, reliable local repro with ib_send_lat.\nPR:N - The attacking peer needs no privileges on the victim host; once a victim SIW client connects to the attacker, the malformed/fragmented MPA reply alone drives the duplicate CONNECT_REPLY upcall.\nUI:N - No additional user action is required beyond the RDMA connection attempt itself; automated or configured SIW clients connecting to a peer are sufficient to expose the path.\nS:U - The impact is a kernel BUG/oops in iw_cm on the same host that runs the SIW client; it does not cross a VM, IOMMU, or other security authority boundary.\nC:N - The failure is a state-machine BUG_ON on a duplicate IW_CM_EVENT_CONNECT_REPLY, not memory corruption or an information leak.\nI:N - There is no write primitive or corruptible object—only an erroneous duplicate CM event that trips an assertion—so integrity is not affected.\nA:H - The duplicate CONNECT_REPLY hits BUG_ON(cm_id_priv->state != IW_CM_STATE_CONN_SENT) in cm_conn_rep_handler, causing a kernel oops/panic and full denial of service."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/infiniband/sw/siw/siw_cm.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
|
|
"lessThan": "11edf0bba15ea9df49478affec7974f351bb2f6e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
|
|
"lessThan": "9ade92ddaf2347fb34298c02080caaa3cdd7c27b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
|
|
"lessThan": "f6e26e1a5f600b760dc32135d3fac846eabe09e7",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
|
|
"lessThan": "0066246d2d7e2619f3ecf3cf07333c59e6e7d84d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
|
|
"lessThan": "1434de50a5d9dab91c8ce031bc23b3e2178379c5",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
|
|
"lessThan": "3056fc6c32e613b760422b94c7617ac9a24a4721",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/infiniband/sw/siw/siw_cm.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.3",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.3",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.211",
|
|
"lessThanOrEqual": "5.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.137",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.61",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.18.18",
|
|
"lessThanOrEqual": "5.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.19.2",
|
|
"lessThanOrEqual": "5.19.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.0",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.3",
|
|
"versionEndExcluding": "5.4.211"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.3",
|
|
"versionEndExcluding": "5.10.137"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.3",
|
|
"versionEndExcluding": "5.15.61"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.3",
|
|
"versionEndExcluding": "5.18.18"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.3",
|
|
"versionEndExcluding": "5.19.2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.3",
|
|
"versionEndExcluding": "6.0"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/11edf0bba15ea9df49478affec7974f351bb2f6e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9ade92ddaf2347fb34298c02080caaa3cdd7c27b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f6e26e1a5f600b760dc32135d3fac846eabe09e7"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0066246d2d7e2619f3ecf3cf07333c59e6e7d84d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1434de50a5d9dab91c8ce031bc23b3e2178379c5"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3056fc6c32e613b760422b94c7617ac9a24a4721"
|
|
}
|
|
],
|
|
"title": "RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |