CVE-2022-3105

What it actually does

Missing NULL check after kmalloc_array in uapi_finalize allows a failed allocation in the InfiniBand uverbs path to be dereferenced, resulting in kernel memory corruption or NULL pointer dereference that crashes the system.

Why it matters to the business

Local users on affected Linux systems can trigger kernel crashes that interrupt workloads, require reboots, and reduce availability of servers or containers running the vulnerable kernel; the issue is years old with no listed fixed versions, increasing long-term exposure risk.

How an attack unfolds

An attacker with local low-privileged access invokes InfiniBand uverbs operations that reach uapi_finalize; the missing check on kmalloc_array allows a NULL pointer to be used, causing a kernel fault and denial of service.

How to fix it

Upgrade to a current Linux kernel release that contains the fix for the missing kmalloc_array check in drivers/infiniband/core/uverbs_uapi.c; apply vendor backports if running enterprise distributions; disable InfiniBand/uverbs if unused.

How to confirm the fix worked

Confirm the vulnerable code path is absent by inspecting the uapi_finalize function for a proper return-value check after kmalloc_array; test by exercising uverbs operations under memory pressure and verifying no kernel oops occurs.

Typical attack path

1. Obtain local shell or process execution on target system
2. Trigger InfiniBand uverbs API calls that exercise uapi_finalize
3. Force allocation failure path to dereference NULL pointer
4. Kernel panics and system becomes unavailable

How to detect it

Review kernel logs for oops or panic messages referencing uverbs_uapi.c or uapi_finalize; look for processes using InfiniBand verbs shortly before crashes.

What your security team should do

• Prioritize kernel updates on any systems exposing InfiniBand or uverbs interfaces
• Monitor for new fixed kernel packages from distribution vendors
• Restrict local access and InfiniBand usage where possible until patched