CVE-2023-52474

What it actually does

The flaw permits data corruption in hfi1 user SDMA packet construction for multi-iovec requests whose non-tail iovecs do not end at PAGE_SIZE boundaries; user_sdma_txadd() copies up to PAGE_SIZE bytes ignoring iov_len, fails to advance iovecs, and mmu_rb_handler exhibits duplicate pinning, insertion races that unpin all pages, and refcount races that permit use-after-free of mmu_rb_node objects dereferenced on request completion.

Why it matters to the business

Organizations running Linux kernels with the hfi1 InfiniBand driver on systems performing user-space SDMA may experience silent data corruption over high-speed fabric links, reducing reliability of storage, HPC, or RDMA workloads and requiring kernel updates to restore correct packet contents.

How an attack unfolds

An attacker with local access submits a user SDMA request containing multiple payload iovecs where intermediate iovecs end short of PAGE_SIZE; the driver then transmits packets containing bytes from adjacent memory, or triggers mmu_rb_handler races that free nodes while other in-flight requests still hold pointers, resulting in corrupted or attacker-controlled data leaving the system.

How to fix it

Upgrade the Linux kernel to a version containing commit 9c4c6512d7330b743c4ffd18bd999a86ca26db0d; rebuild and reboot with the patched kernel; if immediate update is impossible, restrict unprivileged access to the hfi1 SDMA interface via device permissions or cgroups.

How to confirm the fix worked

Confirm the running kernel contains commit 9c4c6512d7330b743c4ffd18bd999a86ca26db0d by checking /proc/version or git log; attempt reproduction with a multi-iovec non-PAGE_SIZE user SDMA request and verify packet contents match the supplied iovec lengths; inspect mmu_rb_handler for duplicate-pin or refcount warnings under load.

Typical attack path

1. Obtain local user or process execution on a system with the hfi1 driver loaded
2. Craft an SDMA request whose iovecs end before page boundaries except for the final iovec
3. Submit the request via the user SDMA interface (Verbs or PSM2 paths avoided)
4. Trigger either the txadd length or iovec-advance bug to send incorrect payload bytes
5. Or force overlapping mmu_rb insertions and refcount races to cause use-after-free during request completion

How to detect it

Search kernel logs for hfi1 SDMA or mmu_rb_handler warnings, page pinning errors, or unexpected use-after-free reports during SDMA request completion; examine audit logs for processes opening /dev/hfi1* devices and issuing SDMA ioctls; correlate with network traffic showing payload mismatches on affected fabrics.

What your security team should do

• Apply the kernel update containing commit 9c4c6512d7330b743c4ffd18bd999a86ca26db0d within the next maintenance window
• Audit systems for presence of the hfi1 driver and user SDMA usage
• Limit local user access to RDMA/SDMA interfaces until patches are deployed
• Monitor vendor advisories for backported fixes in distribution kernels