CVE-2024-50062

What it actually does

Null pointer dereference in RDMA/rtrs-srv path establishment when connection count or CONNECTED state checks are bypassed during info_req exchange, causing kernel crash.

Why it matters to the business

Unexpected crashes on systems using RDMA over fabrics can interrupt storage, networking, or high-performance workloads and require manual recovery or reboots.

How an attack unfolds

An attacker establishes fewer than the expected con_num connections or manipulates timing so the server receives an info_req before all paths reach CONNECTED state, triggering the missing sanity checks and dereferencing a null pointer.

How to fix it

Upgrade the Linux kernel to commit 394b2f4d5e014820455af3eb5859eb328eaafcfd or later; for Rocky Linux 8 Thunderbird packages apply version 91.8.0-1.el8_5 or newer.

How to confirm the fix worked

Confirm kernel version contains the referenced commit; attempt controlled RTRS path establishment with partial connections and verify absence of null dereference oops in dmesg.

Typical attack path

1. Identify target systems exposing RDMA/RTRS services
2. Initiate partial connection establishment with incorrect con_num
3. Send crafted info_req before all paths reach CONNECTED state
4. Trigger null pointer dereference and kernel panic

How to detect it

Review kernel logs for rtrs-srv related null pointer dereference oops or warnings during path establishment; correlate with RDMA connection attempts from untrusted sources.

What your security team should do

• Prioritize kernel updates on all systems exposing RDMA/rtrs-srv
• Monitor for kernel oops involving rtrs_srv during connection establishment
• Restrict RDMA access to trusted initiators until patches are applied