CVE-2022-29156

What it actually does

Double-free condition in drivers/infiniband/ulp/rtrs/rtrs-clt.c during rtrs_clt_dev_release leads to kernel memory corruption with potential for arbitrary code execution or privilege escalation.

Why it matters to the business

Local attackers on affected Linux systems can gain elevated privileges or crash the kernel, risking data breaches, service disruption, and unauthorized access to sensitive workloads.

How an attack unfolds

An attacker with local user access crafts or triggers RDMA/RTRS client device operations that reach the flawed release path, causing the double free and subsequent memory corruption that can be leveraged for code execution.

How to fix it

Upgrade the Linux kernel to a version containing commit 8700af2cc18c919b2a83e74e0479038fd113c15d or later; apply vendor-supplied kernel packages that include the fix.

How to confirm the fix worked

Confirm kernel source or package version contains commit 8700af2cc18c919b2a83e74e0479038fd113c15d; verify the rtrs_clt_dev_release function no longer contains the duplicate kfree calls.

Typical attack path

1. Obtain local shell or process execution on target Linux host
2. Interact with Infiniband/RDMA subsystem to instantiate rtrs client device
3. Trigger device release sequence that exercises the double-free path
4. Exploit resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs and crash dumps for signs of memory corruption or oops in rtrs module; examine audit logs for unusual RDMA device creation or release activity by non-privileged users.

What your security team should do

• Prioritize kernel updates on systems exposing RDMA/Infiniband interfaces
• Restrict local user access to RDMA-capable hardware where feasible
• Monitor for new kernel releases and schedule staged rollouts
• Audit systems for unpatched kernels older than the fixed commit