CVE-2023-52513

What it actually does

NULL pointer dereference in siw_cm_work_handler() triggered when immediate MPA request processing fails on an RDMA/siw endpoint, causing kernel crash on subsequent TCP socket close; also leaves MPA timeout active.

Why it matters to the business

Local denial-of-service on Linux systems using RDMA/siw, leading to unplanned reboots, service disruption, and potential data loss for workloads relying on kernel RDMA.

How an attack unfolds

An attacker with local access triggers immediate failure of MPA request processing on a newly created siw endpoint, allowing the endpoint to be dropped while still referenced; closing the associated TCP socket then causes the handler to dereference a NULL listener pointer.

How to fix it

Apply the upstream fix commit 6e26812e289b374c17677d238164a5a8f5770594 or upgrade to a Linux kernel containing this commit; disable RDMA/siw if the feature is unused.

How to confirm the fix worked

Confirm kernel source contains commit 6e26812e289b374c17677d238164a5a8f5770594 or verify the siw_cm_work_handler() path no longer dereferences a potentially NULL listener after MPA failure.

Typical attack path

1. Obtain local access to a Linux system with RDMA/siw enabled
2. Force immediate MPA request processing failure on a new connection
3. Trigger TCP socket close while the endpoint is in the unhandled dropped state
4. Cause NULL dereference crash in siw_cm_work_handler()

How to detect it

Search kernel logs and crash dumps for oops/panic messages referencing siw_cm_work_handler and NULL listener dereference; look for unexpected MPA timeout cancellations or RDMA connection failures preceding crashes.

• siw_cm_work_handler
• NULL listener
• MPA request processing fails

What your security team should do

• Patch affected kernels to the fixed commit immediately due to memory corruption risk
• Audit systems for RDMA/siw usage and prioritize those with network-facing RDMA workloads
• Monitor kernel logs for siw-related oops until patches are deployed