kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

A flaw was found in the net/mlx5 driver of the Linux kernel. When the driver attempts to read the MCIA register from a device advertising the mcia32dwords capability, the mlx5querymcia function can read more data than the allocated buffer can hold. This leads to a buffer overflow, which can cause...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

A flaw was found in the Linux kernel's RDMA/mlx5 component. An error path fall-through in the mlx5ibdevressrqinit function, specifically when ibcreatesrq fails, can lead to the use of freed memory and error pointers. This memory corruption vulnerability could result in system instability, denial ...

kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

A flaw was found in the net/mlx5 driver of the Linux kernel. When the driver attempts to read the MCIA register from a device advertising the mcia32dwords capability, the mlx5querymcia function can read more data than the allocated buffer can hold. This leads to a buffer overflow, which can cause...

Unbreakable Enterprise kernel security update

5.4.17-2136.361.4.1 - iommu/amd: Force device table to maximum size Suravee Suthikulpanit Orabug: 40172712 CVE-2024-21963 - x86/microcode/AMD: Increase PATCHMAXSIZE for Family 1Ah Saeed Mirzamohammadi Orabug: 40172712 5.4.17-2136.361.4 - vhost-scsi: zero misaligned I/O bounce pages Shubham Antil...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix matcher leak on resize target setup failure hwsbwcmatchermove allocates a replacement matcher before setting it as the resize target. If mlx5hwsmatcherresizesettarget fails, the replacement matcher is not...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpfxdppulldata or bpfxdpadjusttail. The referenced commit in the fixes tag...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5eswitchtermtblput In mlx5eswitchtermtblput, the zero-ref cleanup check reads tt-refcount after termtblmutex has been released. Two concurrent callers on the same mlx5termtblhandle rac...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpfxdppulldata or bpfxdpadjusttail. The commit referenced in the fixes tag correct...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one Release the UAR index returned by the hardware...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/mlx5: Fixed the issue where UMR XLT cleanup was performed during ODDP population failures. The mlx5rumrupdatexlt function allocates and DMA maps an XLT buffer using mlx5rumrcreatexlt. The buffer is released through the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG – Fixed an off-by-one issue in the rollback of single-FDB errors. When a failure occurs at index i, the reverse cleanup loop in mlx5lagcreatesinglefdb starts from i. As a result, the failed index itself is rolled...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: net/mlx5: The free mlx5stidxdata operation in the final deallocation step was corrected. Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g., churning RDMA MRs cause a leak of one struct...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords 128 bytes when the device advertises the mcia32dwords capability; however, struct mlx5ifcmciaregbits only defines...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5IBMETHODDEVXSUBSCRIBEEVENT links eventsub into sublist before initializing the fields used by the shared error path. If eventfdctxfdget then fails, the unwind path...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix race conditions in bitfields and improve struct layout Bitfield operations are not atomic; they follow a read-modify-write pattern. Therefore, we must be careful not to pack bitfields that can be concurrently updat...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it using the signed "%d" format into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: fix wrong list iterated in adddirectchain error path In adddirectchain, newly allocated direct MR entries are added to the local list ‘tmp’, which is spliced into mr-head only on success. On the error path, the cleanup...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size setrqsize computes the RQ WQE size as “1 rqwqeshift” based on the user-provided rqwqeshift parameter; this value is only checked to ensure it is greater than 32, so shifts of 32...