CVE-2023-53110

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()

When performing a stress test on SMC-R by rmmod mlx5_ib driver

during the wrk/nginx test, we found that there is a probability

of triggering a panic while terminating all link groups.

This issue dues to the race between smc_smcr_terminate_all()

and smc_buf_create().

smc_smcr_terminate_all

smc_buf_create

/* init */

conn->sndbuf_desc = NULL;

...

__smc_lgr_terminate

smc_conn_kill

smc_close_abort

smc_cdc_get_slot_and_msg_send

__softirqentry_text_start

smc_wr_tx_process_cqe

smc_cdc_tx_handler

READ(conn->sndbuf_desc->len);

/* panic dues to NULL sndbuf_desc */

conn->sndbuf_desc = xxx;

This patch tries to fix the issue by always to check the sndbuf_desc

before send any cdc msg, to make sure that no null pointer is

seen during cqe processing.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References