CVE-2023-52775

What it actually does

Race condition in Linux kernel SMC-R implementation allows a DECLINE message to be read by a fallback TCP connection after LLC confirm timeouts, causing protocol control data to be delivered to user-space applications as payload and resulting in data corruption.

Why it matters to the business

Applications using SMC-R on Linux may experience intermittent data corruption and protocol errors that are difficult to reproduce, leading to application instability and potential silent data integrity issues in production workloads.

How an attack unfolds

An attacker triggers the timing window during SMC connection setup where the client and server both timeout on LLC confirm messages; the subsequent DECLINE messages are then delivered over the fallback TCP socket to the application, injecting raw protocol bytes into the data stream.

How to fix it

Update the Linux kernel to a version containing commit 5ada292b5c504720a0acef8cae9acc62a694d19c which doubles the client timeout value relative to the server to prevent DECLINE message collision.

How to confirm the fix worked

Confirm the presence of commit 5ada292b5c504720a0acef8cae9acc62a694d19c in the running kernel source or verify that SMC connection setup no longer produces protocol bytes in application data streams under the described timeout conditions.

Typical attack path

1. Initiate SMC-R connection between client and server
2. Force LLC confirm exchange to fail on both sides
3. Allow client and server timeout periods to expire
4. Deliver DECLINE messages that cross the fallback TCP connection
5. Read corrupted protocol bytes as application data

How to detect it

Search application and kernel logs for SMC DECLINE message patterns or the exact byte sequence beginning with 0xE2 0xD4 0xC3 0xD9 appearing where application data is expected; inspect TCP fallback paths during connection establishment for protocol messages.

What your security team should do

• Prioritize kernel updates on systems using SMC-R (especially Redis and similar high-throughput workloads)
• Monitor for the specific protocol error strings and unexpected byte sequences in application logs
• Test the fix under simulated timeout conditions before broad deployment