CVE-2024-53094

What it actually does

The RDMA/siw driver omits a sendpage_ok() check before setting MSG_SPLICE_PAGES, allowing slab pages to reach skb_splice_from_iter and trigger warnings or incorrect page handling in the TCP send path.

Why it matters to the business

Systems using iSER over Soft iWARP may experience kernel warnings, potential performance degradation, or instability during RDMA storage traffic; older Ubuntu busybox packages and unpatched kernels remain exposed until updated.

How an attack unfolds

An attacker establishes an iSER session over SIW, sends carefully crafted RDMA operations that trigger siw_tx_hdt with slab-backed buffers, and forces the network stack to process the invalid pages, resulting in the observed warning and possible follow-on memory or stability issues.

How to fix it

Upgrade the Linux kernel to commit 3406bfc813a9bbd9c3055795e985f527b7852e8c or later; for affected Ubuntu releases apply the listed busybox updates (1:1.21.0-1ubuntu1.4 for 14.04, 1:1.22.0-15ubuntu1.4 for 16.04, 1:1.27.2-1ubuntu3 for 18.04) and reboot.

How to confirm the fix worked

Confirm the kernel contains commit 3406bfc813a9bbd9c3055795e985f527b7852e8c, verify busybox package versions match the fixed releases, and test that iSER over SIW no longer produces the skb_splice_from_iter warning under load.

Typical attack path

1. Compromise or control a host with SIW-enabled RDMA stack
2. Initiate iSER login and queue SQ operations that use slab pages
3. Trigger siw_qp_sq_process and siw_tx_hdt without sendpage_ok validation
4. Cause skb_splice_from_iter to warn and mishandle the page
5. Observe kernel log impact or leverage for further local/kernel exploitation

How to detect it

Search kernel logs for the exact skb_splice_from_iter warning and call trace containing siw_tx_hdt, siw_qp_sq_process, and tcp_sendmsg_locked; inspect SIW-enabled hosts for recent RDMA session activity coinciding with the warning.

• skb_splice_from_iter+0x173/0x320
• siw_tx_hdt+0x695/0xa40 [siw]
• WARNING: CPU:.*at net/core/skbuff.c:7140

What your security team should do

• Prioritize kernel and busybox updates on all systems exposing SIW/RDMA interfaces
• Monitor kernel logs for skb_splice_from_iter warnings on RDMA hosts
• Disable SIW or iSER temporarily if patching cannot be completed before the next maintenance window
• Review downstream dependents of the affected kernel packages for additional exposure