CVE-2023-52744

What it actually does

Potential NULL pointer dereference in RDMA/irdma when in_dev_get() returns NULL before dereference in in_dev_for_each_ifa_rtnl().

Why it matters to the business

May cause system instability or denial of service on Linux systems using RDMA networking hardware, though exploitation likelihood remains low.

How an attack unfolds

An attacker with local access or ability to influence network interface configuration triggers the RDMA/irdma code path where in_dev_get() returns NULL, resulting in an immediate kernel crash upon dereference.

How to fix it

Apply the upstream fix by updating to a kernel containing commit 8f5fe1cd8e6a97f94840b55f59ed08cbc397086f or later equivalent stable release.

How to confirm the fix worked

Verify presence of the NULL check before dereference in the irdma source or confirm kernel version includes the referenced commit.

Typical attack path

1. Identify system with RDMA/irdma enabled and vulnerable kernel version
2. Manipulate network interface state to cause in_dev_get() to return NULL
3. Trigger RDMA operations invoking in_dev_for_each_ifa_rtnl()
4. Cause kernel NULL dereference leading to panic or oops

How to detect it

Review kernel logs for oops or panic messages referencing irdma and NULL pointer dereference around in_dev_for_each_ifa_rtnl calls; inspect for unexpected RDMA interface state changes preceding crashes.

What your security team should do

• Patch affected kernels to the fixed commit immediately if RDMA/irdma is in use
• Disable RDMA/irdma interfaces where not required as a temporary mitigation
• Monitor kernel logs for NULL dereference oops in irdma modules