CVE-2023-53476

What it actually does

Incorrect conditional check after reassigning the epcp pointer allows a NULL dereference of listen_ep or ep when handling LISTEN state in c4iw_fill_res_cm_id_entry, resulting in kernel memory corruption.

Why it matters to the business

Kernel crashes or potential code execution in privileged context can cause system downtime, data loss, or full host compromise on affected Linux systems using the cxgb4 RDMA driver.

How an attack unfolds

An attacker triggers the specific code path in the iw_cxgb4 driver by establishing or tearing down RDMA connections in a way that hits the mismatched LISTEN state check after pointer reassignment, leading to dereference of a NULL pointer.

How to fix it

Update the Linux kernel to a version containing commit 76e0396313c79ecd0df44ee3c18745cfac52b3e6 or later. Rebuild and reboot with the patched kernel; apply vendor backports if available for distribution kernels.

How to confirm the fix worked

Confirm the running kernel contains commit 76e0396313c79ecd0df44ee3c18745cfac52b3e6 via git log or package version checks; attempt to exercise the c4iw_fill_res_cm_id_entry function under LISTEN conditions in a test environment to verify absence of the dereference.

Typical attack path

1. Identify a system using the cxgb4 Infiniband/RDMA driver
2. Craft network or local RDMA operations that reach c4iw_fill_res_cm_id_entry with LISTEN state
3. Trigger the second state check after epcp reassignment to cause NULL dereference
4. Crash the kernel or attempt to leverage the corruption for privilege escalation

How to detect it

Review kernel logs for oops/panic messages mentioning iw_cxgb4 or c4iw_fill_res_cm_id_entry; search audit or system logs for unusual RDMA connection patterns around the time of any crash.

What your security team should do

• Prioritize kernel updates on systems exposing RDMA or using cxgb4 hardware
• Monitor for kernel oops or panic logs referencing iw_cxgb4 or c4iw_fill_res_cm_id_entry
• Restrict untrusted RDMA access until patches are applied