CVE-2022-48925

What it actually does

Unconditional overwrite of route.addr.src_addr in resolve_prepare_src() bypasses state checks for non-idle RDMA_CM states, corrupting src_addr and causing use-after-free on rdma_id_private objects during subsequent list operations in cma_listen_on_all and related functions.

Why it matters to the business

Linux systems relying on RDMA for high-performance networking face risk of kernel crashes, denial of service, or potential privilege escalation, impacting stability of storage, clustering, and HPC workloads; long publication window increases exposure for unpatched kernels.

How an attack unfolds

An attacker with local access invokes RDMA CM operations such as ucma_listen while the connection ID is in a non-idle state (for example RDMA_CM_LISTEN), triggering the unconditional src_addr overwrite; this leads to invalid state checks in cma_cancel_operation and a use-after-free when the freed rdma_id_private is later accessed during list manipulation.

How to fix it

Upgrade the Linux kernel to a version containing commit 5b1cef5798b4fd6e4fd5522e7b8a26248beeacaa or apply the equivalent stable backport; rebuild and reboot with the patched kernel; disable RDMA interfaces if immediate patching is not feasible.

How to confirm the fix worked

Verify the running kernel contains commit 5b1cef5798b4fd6e4fd5522e7b8a26248beeacaa via git log or package version; attempt to reproduce the original syzkaller reproducer and confirm absence of KASAN use-after-free reports in cma.c.

Typical attack path

1. Obtain local user privileges on a Linux system with RDMA subsystem enabled
2. Invoke RDMA CM listen or bind operations via ucma or cma interfaces in a non-idle state
3. Trigger resolve_prepare_src to corrupt src_addr
4. Cause subsequent cma_listen_on_all or rdma_listen to dereference freed object
5. Exploit resulting use-after-free for crash or code execution

How to detect it

Search kernel logs and crash dumps for KASAN use-after-free reports in __list_add_valid or list_debug.c triggered from cma_listen_on_all or rdma_listen paths; inspect dmesg and syslog for syz-executor or ucma_write call traces involving RDMA CM state corruption.

• BUG: KASAN: use-after-free in __list_add_valid
• cma_listen_on_all drivers/infiniband/core/cma.c
• rdma_listen+0x787/0xe00
• ucma_listen+0x16a/0x210
• if (cma_any_addr(cma_src_addr(id_priv)) && !id_priv->cma_dev)

What your security team should do

• Prioritize kernel upgrade on all systems exposing RDMA interfaces
• Audit and restrict unprivileged access to /dev/infiniband and RDMA syscalls
• Monitor for kernel oops or KASAN reports referencing cma_listen_on_all or __list_add_valid
• Test patched kernels in staging environments before broad deployment