CVE-2022-50736 (GCVE-0-2022-50736)
Vulnerability from cvelistv5
Published
2025-12-24 12:22
Modified
2026-08-05 08:59
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix immediate work request flush to completion queue Correctly set send queue element opcode during immediate work request flushing in post sendqueue operation, if the QP is in ERROR state. An undefined ocode value results in out-of-bounds access to an array for mapping the opcode between siw internal and RDMA core representation in work completion generation. It resulted in a KASAN BUG report of type 'global-out-of-bounds' during NFSoRDMA testing. This patch further fixes a potential case of a malicious user which may write undefined values for completion queue elements status or opcode, if the CQ is memory mapped to user land. It avoids the same out-of-bounds access to arrays for status and opcode mapping as described above.
References
Impacted products
Vendor Product Version
Linux Linux Version: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b
Version: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b
Version: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b
Version: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b
Version: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b
Version: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_cq.c",
            "drivers/infiniband/sw/siw/siw_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6af043089d3f1210776d19b6fdabea610d4c7699",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "75af03fdf35acf15a3977f7115f6b8d10dff4bc7",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "f8d8fbd3b6d6cc3f25790cca5cffe8ded512fef6",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "355d2eca68c10d713a42f68e62044b3d1c300471",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "f3d26a8589dfdeff328779b511f71fb90b10005e",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "bdf1da5df9da680589a7f74448dd0a94dd3e1446",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_cq.c",
            "drivers/infiniband/sw/siw/siw_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix immediate work request flush to completion queue\n\nCorrectly set send queue element opcode during immediate work request\nflushing in post sendqueue operation, if the QP is in ERROR state.\nAn undefined ocode value results in out-of-bounds access to an array\nfor mapping the opcode between siw internal and RDMA core representation\nin work completion generation. It resulted in a KASAN BUG report\nof type \u0027global-out-of-bounds\u0027 during NFSoRDMA testing.\n\nThis patch further fixes a potential case of a malicious user which may\nwrite undefined values for completion queue elements status or opcode,\nif the CQ is memory mapped to user land. It avoids the same out-of-bounds\naccess to arrays for status and opcode mapping as described above."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable paths are local RDMA uverbs operations on SoftiWARP: a user mmaps a CQ, poisons CQE opcode/status, and triggers siw_reap_cqe via destroy/flush (or the in-kernel post_send flush path). Remote iWARP peers do not supply CQE opcode/status fields.\nAC:L - An attacker fully controls CQ creation, mmap writes of SIW_WQE_VALID plus arbitrary __u8 opcode/__u16 status, and CQ destroy that calls siw_cq_flush\u2192siw_reap_cqe, so the OOB index is deterministic with no race or external precondition.\nPR:L - uverbs nodes are created mode 0666 with no capability check in ib_uverbs_open, and create_cq/mmap/destroy require no CAP_*; on systems with an existing siw device this is ordinary unprivileged local access (same model as other RDMA uverbs scores).\nUI:N - The attacker opens uverbs, creates and mmaps their own CQ, poisons CQEs, and destroys the CQ themselves; no separate victim action is required.\nS:U - Impact is confined to host-kernel memory access and crash within SoftiWARP/RDMA core on the same OS authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Malicious mmapped CQEs supply an unbounded __u16 status (and __u8 opcode) used as indexes into small static map_cqe_status/map_wc_opcode arrays, yielding a large attacker-chosen global out-of-bounds read; per guidance, OOB reads that are not strictly bounded are Confidentiality High.\nI:N - The defect only performs out-of-bounds loads from the mapping arrays into a local ib_wc; there is no OOB write, heap corruption, or control-flow hijack primitive in the vulnerable path.\nA:H - KASAN already reported global-out-of-bounds on this path, and a large status index reliably faults on unmapped kernel addresses during CQ flush/reap, producing a kernel oops/panic and full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:32.604Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6af043089d3f1210776d19b6fdabea610d4c7699"
        },
        {
          "url": "https://git.kernel.org/stable/c/75af03fdf35acf15a3977f7115f6b8d10dff4bc7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8d8fbd3b6d6cc3f25790cca5cffe8ded512fef6"
        },
        {
          "url": "https://git.kernel.org/stable/c/355d2eca68c10d713a42f68e62044b3d1c300471"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3d26a8589dfdeff328779b511f71fb90b10005e"
        },
        {
          "url": "https://git.kernel.org/stable/c/bdf1da5df9da680589a7f74448dd0a94dd3e1446"
        }
      ],
      "title": "RDMA/siw: Fix immediate work request flush to completion queue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50736",
    "datePublished": "2025-12-24T12:22:54.695Z",
    "dateReserved": "2025-12-24T12:20:40.331Z",
    "dateUpdated": "2026-08-05T08:59:32.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.