CVE-2024-40992 (GCVE-0-2024-40992)
Vulnerability from cvelistv5
Published
2024-07-12 12:37
Modified
2026-08-05 11:34
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder length checking for UD request packets According to the IBA specification: If a UD request packet is detected with an invalid length, the request shall be an invalid request and it shall be silently dropped by the responder. The responder then waits for a new request packet. commit 689c5421bfe0 ("RDMA/rxe: Fix incorrect responder length checking") defers responder length check for UD QPs in function `copy_data`. But it introduces a regression issue for UD QPs. When the packet size is too large to fit in the receive buffer. `copy_data` will return error code -EINVAL. Then `send_data_in` will return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into ERROR state.
References
Impacted products
Vendor Product Version
Linux Linux Version: 689c5421bfe0eac65526bd97a466b9590a6aad3c
Version: 689c5421bfe0eac65526bd97a466b9590a6aad3c
Version: 689c5421bfe0eac65526bd97a466b9590a6aad3c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:39:56.166Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40992",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:01:44.819044Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:20.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_resp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "163868ec1f6c610d16da9e458fe1dd7d5de97341",
              "status": "affected",
              "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c",
              "versionType": "git"
            },
            {
              "lessThan": "943c94f41dfe36536dc9aaa12c9efdf548ceb996",
              "status": "affected",
              "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c",
              "versionType": "git"
            },
            {
              "lessThan": "f67ac0061c7614c1548963d3ef1ee1606efd8636",
              "status": "affected",
              "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_resp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.36",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.7",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix responder length checking for UD request packets\n\nAccording to the IBA specification:\nIf a UD request packet is detected with an invalid length, the request\nshall be an invalid request and it shall be silently dropped by\nthe responder. The responder then waits for a new request packet.\n\ncommit 689c5421bfe0 (\"RDMA/rxe: Fix incorrect responder length checking\")\ndefers responder length check for UD QPs in function `copy_data`.\nBut it introduces a regression issue for UD QPs.\n\nWhen the packet size is too large to fit in the receive buffer.\n`copy_data` will return error code -EINVAL. Then `send_data_in`\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\nERROR state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The rxe driver processes RoCEv2 packets received on UDP port 4791 from arbitrary remote peers over routed IP networks, and the malformed UD request is handled directly in the responder receive path. No adjacency or local access is required.\nAC:L - A single crafted UD SEND packet whose payload exceeds the receiver\u0027s posted receive buffer deterministically triggers the wrong error class and the QP error transition; there is no race, no memory-layout dependency, and the GSI Q_Key is a hardcoded well-known constant.\nPR:N - RoCE provides no authentication, check_addr() performs no source validation for UD/GSI QPs, the default full P_Key always matches, and QPN 1 uses the fixed GSI_QKEY value \u2014 so a completely unauthenticated off-system attacker can reach the vulnerable code.\nUI:N - The vulnerability is triggered entirely by an inbound packet processed asynchronously by the responder task; no action by any local user or application is needed.\nS:U - The impact is confined to the kernel\u0027s RDMA subsystem on the target host, within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - copy_data() still bounds the transfer against dma.resid, so no out-of-bounds read occurs and no memory contents are disclosed; the defect is only the error code returned on an already-detected overlong payload.\nI:N - There is no memory corruption or out-of-bounds write \u2014 the receive-buffer copy remains bounded and the failure is reported to the application via an error completion, so no data is silently modified.\nA:H - A single unauthenticated packet permanently forces the UD/GSI queue pair into IB_QPS_ERR via rxe_qp_error(), flushing all work requests and rendering the QP unusable until the application tears it down and recreates it; killing QP1 disables the MAD agent and thus RDMA-CM connection establishment for the entire device, and one multicast packet can destroy every QP in a group."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:30.286Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"
        },
        {
          "url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"
        },
        {
          "url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"
        }
      ],
      "title": "RDMA/rxe: Fix responder length checking for UD request packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40992",
    "datePublished": "2024-07-12T12:37:35.800Z",
    "dateReserved": "2024-07-12T12:17:45.605Z",
    "dateUpdated": "2026-08-05T11:34:30.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:39:56.166Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40992\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:01:44.819044Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:22.062Z\"}}], \"cna\": {\"title\": \"RDMA/rxe: Fix responder length checking for UD request packets\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The rxe driver processes RoCEv2 packets received on UDP port 4791 from arbitrary remote peers over routed IP networks, and the malformed UD request is handled directly in the responder receive path. No adjacency or local access is required.\\nAC:L - A single crafted UD SEND packet whose payload exceeds the receiver\u0027s posted receive buffer deterministically triggers the wrong error class and the QP error transition; there is no race, no memory-layout dependency, and the GSI Q_Key is a hardcoded well-known constant.\\nPR:N - RoCE provides no authentication, check_addr() performs no source validation for UD/GSI QPs, the default full P_Key always matches, and QPN 1 uses the fixed GSI_QKEY value \\u2014 so a completely unauthenticated off-system attacker can reach the vulnerable code.\\nUI:N - The vulnerability is triggered entirely by an inbound packet processed asynchronously by the responder task; no action by any local user or application is needed.\\nS:U - The impact is confined to the kernel\u0027s RDMA subsystem on the target host, within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:N - copy_data() still bounds the transfer against dma.resid, so no out-of-bounds read occurs and no memory contents are disclosed; the defect is only the error code returned on an already-detected overlong payload.\\nI:N - There is no memory corruption or out-of-bounds write \\u2014 the receive-buffer copy remains bounded and the failure is reported to the application via an error completion, so no data is silently modified.\\nA:H - A single unauthenticated packet permanently forces the UD/GSI queue pair into IB_QPS_ERR via rxe_qp_error(), flushing all work requests and rendering the QP unusable until the application tears it down and recreates it; killing QP1 disables the MAD agent and thus RDMA-CM connection establishment for the entire device, and one multicast packet can destroy every QP in a group.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"689c5421bfe0eac65526bd97a466b9590a6aad3c\", \"lessThan\": \"163868ec1f6c610d16da9e458fe1dd7d5de97341\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"689c5421bfe0eac65526bd97a466b9590a6aad3c\", \"lessThan\": \"943c94f41dfe36536dc9aaa12c9efdf548ceb996\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"689c5421bfe0eac65526bd97a466b9590a6aad3c\", \"lessThan\": \"f67ac0061c7614c1548963d3ef1ee1606efd8636\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/sw/rxe/rxe_resp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.36\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/sw/rxe/rxe_resp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341\"}, {\"url\": \"https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996\"}, {\"url\": \"https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/rxe: Fix responder length checking for UD request packets\\n\\nAccording to the IBA specification:\\nIf a UD request packet is detected with an invalid length, the request\\nshall be an invalid request and it shall be silently dropped by\\nthe responder. The responder then waits for a new request packet.\\n\\ncommit 689c5421bfe0 (\\\"RDMA/rxe: Fix incorrect responder length checking\\\")\\ndefers responder length check for UD QPs in function `copy_data`.\\nBut it introduces a regression issue for UD QPs.\\n\\nWhen the packet size is too large to fit in the receive buffer.\\n`copy_data` will return error code -EINVAL. Then `send_data_in`\\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\\nERROR state.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.36\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.7\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:34:30.286Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40992\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:34:30.286Z\", \"dateReserved\": \"2024-07-12T12:17:45.605Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:37:35.800Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.