CVE-2024-57857

What it actually does

The vulnerability is a use-after-free in the RDMA/siw driver where a direct per-device link to net_device was improperly managed, leading to slab-use-after-free during siw_query_port() calls.

Why it matters to the business

Kernel crashes or potential privilege escalation on affected Linux systems can cause service outages, data loss, and require emergency maintenance, with higher urgency for organizations running RDMA workloads.

How an attack unfolds

An attacker with local access or ability to trigger RDMA operations invokes siw_query_port on a device with a stale net_device reference, dereferencing freed memory to trigger the use-after-free and potentially escalate privileges.

How to fix it

Update the Linux kernel to include commit 4eafeb4f021c50d13f199239d913b37de3c83135 or apply the fixed versions listed for affected packages such as libapache-poi-java on Ubuntu 20.04/22.04 where applicable.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or retest siw_query_port under KASAN to ensure no slab-use-after-free occurs.

Typical attack path

1. Locate systems running vulnerable Linux kernels with RDMA/siw enabled
2. Trigger siw_query_port via RDMA port query operations
3. Exploit the resulting use-after-free for code execution or denial of service

How to detect it

Search kernel logs and KASAN reports for slab-use-after-free exceptions mentioning siw_query_port or net_device references.

What your security team should do

• Prioritize kernel upgrades on all production systems within the remediation window
• Disable RDMA/siw interfaces where not required until patched
• Monitor kernel logs for KASAN warnings related to siw