CVE-2024-40992

What it actually does

Improper length validation for UD request packets in RDMA/rxe causes copy_data to return -EINVAL on oversized packets, triggering RESPST_ERR_MALFORMED_WQE and transitioning the UD QP into the ERROR state instead of silently dropping the packet per IBA spec.

Why it matters to the business

Disrupts high-performance RDMA networking in Linux-based clusters and storage systems, leading to connection failures, application downtime, and degraded performance in environments relying on RDMA over Converged Ethernet or InfiniBand.

How an attack unfolds

An attacker sends UD request packets exceeding the receive buffer size to a vulnerable Linux kernel with RDMA/rxe enabled; the deferred length check in copy_data fails, send_data_in returns a malformed WQE error, and the QP enters ERROR state, halting further communication.

How to fix it

Upgrade the Linux kernel to the commit 163868ec1f6c610d16da9e458fe1dd7d5de97341 or later stable releases containing the fix; rebuild and deploy the updated kernel across affected systems; verify RDMA/rxe functionality post-upgrade.

How to confirm the fix worked

Confirm the running kernel contains commit 163868ec1f6c610d16da9e458fe1dd7d5de97341 via git log or uname; test RDMA UD traffic with oversized packets to ensure silent drop behavior instead of QP error state.

Typical attack path

1. Identify target systems exposing RDMA/rxe UD queue pairs
2. Craft and transmit oversized UD request packets
3. Trigger responder length check regression in copy_data
4. Force RESPST_ERR_MALFORMED_WQE and QP ERROR transition
5. Observe service disruption or repeated connection resets

How to detect it

Review kernel logs for RESPST_ERR_MALFORMED_WQE messages and UD QP state transitions to ERROR; inspect RDMA/rxe tracepoints and dmesg output around the time of suspected oversized packet reception.

What your security team should do

• Prioritize kernel upgrades to the fixed commit on all systems using RDMA/rxe
• Monitor for QP error state transitions in RDMA logs during normal operation
• Temporarily disable RDMA/rxe UD support if immediate patching is not feasible
• Validate post-upgrade behavior with targeted packet-size stress tests