CVE-2021-47080

What it actually does

User-controlled zero value for user_entry_size is used directly as a divisor when computing the number of entries during RDMA GID table query handling, producing a kernel divide-by-zero exception in ib_uverbs_handler_UVERBS_METHOD_QUERY_GID_TABLE.

Why it matters to the business

Systems using RDMA can be crashed by local or unprivileged processes, causing denial of service, loss of connectivity, and unplanned reboots in high-performance computing or storage environments.

How an attack unfolds

An attacker invokes the UVERBS_METHOD_QUERY_GID_TABLE ioctl with a zero-length user_entry_size; the kernel performs an unchecked division, triggering a fatal exception and kernel panic.

How to fix it

Update the Linux kernel to a version containing the validation that rejects zero user_entry_size before the division; rebuild and reboot affected nodes.

How to confirm the fix worked

Confirm the patched handler performs an explicit check that user_entry_size is non-zero; attempt a zero-size query and verify the call is rejected without a kernel oops.

Typical attack path

1. Gain local execution on a host exposing RDMA interfaces
2. Open /dev/infiniband/uverbsX
3. Craft and submit an ioctl containing zero user_entry_size for QUERY_GID_TABLE
4. Trigger the divide-by-zero path in the RDMA core handler

How to detect it

Search kernel logs for divide-error oops containing ib_uverbs_handler_UVERBS_METHOD_QUERY_GID_TABLE, KASAN reports referencing the division, or processes invoking RDMA ioctls shortly before a crash.

• ib_uverbs_handler_UVERBS_METHOD_QUERY_GID_TABLE+0x1b1/0x510
• divide error: 0000 [#1] SMP KASAN PTI
• UVERBS_METHOD_QUERY_GID_TABLE

What your security team should do

• Apply the upstream fix to all RDMA-capable kernels
• Restrict unprivileged access to /dev/infiniband devices
• Harden user-space RDMA libraries to sanitize entry-size parameters