CVE-2023-2176

What it actually does

Improper cleanup in compare_netdev_and_ip in drivers/infiniband/core/cma.c causes an out-of-bounds read in the RDMA core, enabling a local user to trigger memory corruption for denial of service or privilege escalation.

Why it matters to the business

Local attackers on affected Linux systems can crash servers or gain elevated access, leading to service outages and potential full host compromise; low urgency given age and lack of active exploitation in ransomware or KEV.

How an attack unfolds

A local attacker with access to RDMA interfaces supplies crafted network device or IP data to the vulnerable comparison function, triggering the out-of-bounds read to corrupt memory state and escalate privileges or crash the kernel.

How to fix it

Update the Linux kernel to a version containing commit 61adba85cc40287232a539e607164f273260e0fe; rebuild and reboot with the patched kernel; disable RDMA interfaces if patching is delayed.

How to confirm the fix worked

Verify the running kernel contains commit 61adba85cc40287232a539e607164f273260e0fe via git log or source inspection; confirm absence of the vulnerable compare_netdev_and_ip path in drivers/infiniband/core/cma.c.

Typical attack path

1. Obtain local shell on target Linux system with RDMA enabled
2. Invoke RDMA connection manager APIs or trigger compare_netdev_and_ip via userspace tooling
3. Supply malicious input that bypasses cleanup and causes out-of-bounds read
4. Leverage resulting memory corruption for privilege escalation or kernel panic

How to detect it

Review kernel logs and dmesg for RDMA CMA crashes or oops involving compare_netdev_and_ip; correlate with unexpected privilege changes or new root processes shortly after RDMA activity.

• compare_netdev_and_ip
• drivers/infiniband/core/cma.c
• RDMA CMA out-of-bounds read

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all RDMA-enabled hosts
• Restrict untrusted local user access to RDMA devices until patched
• Monitor kernel logs for RDMA-related oops or privilege-escalation events