CVE-2024-57890

What it actually does

Integer overflow in user-controlled u32 multiplications for RDMA command sizes (wqe_size * wr_count and sge_count * sizeof(struct ib_uverbs_sge)) that can wrap before being passed to uverbs_request_next_ptr, allowing invalid pointer arithmetic or memory operations on 32-bit systems.

Why it matters to the business

May cause crashes, memory corruption, or bypasses in Linux environments using RDMA/InfiniBand, increasing operational risk for high-performance computing and storage clusters; low exploit likelihood but affects widely deployed kernel code with many downstream dependents.

How an attack unfolds

An attacker supplies crafted RDMA uverbs commands containing large u32 values that trigger wrapping multiplications; the wrapped result is used in pointer calculations inside uverbs_request_next_ptr, potentially enabling out-of-bounds access or invalid memory operations. Threat actors in 2024 espionage and financially motivated campaigns have targeted similar Linux kernel input validation issues.

How to fix it

Apply the upstream fix in commit c57721b24bd897338a81a0ca5fff41600f0f1ad1 or later; for Ubuntu 18.04 LTS update taglib to 1.11.1+dfsg.1-0.2build2. Rebuild and deploy kernels that use size_mul() for all user-controlled size calculations.

How to confirm the fix worked

Confirm kernel sources contain the size_mul() calls and rearranged comparison in uverbs_request_next_ptr(); verify running kernel version or commit hash matches the fixed revision; test with crafted large-value RDMA commands under sanitizers.

Typical attack path

1. Craft RDMA uverbs command with oversized wqe_size, wr_count or sge_count values
2. Trigger integer wrapping during multiplication
3. Pass wrapped size to uverbs_request_next_ptr without proper bounds check
4. Achieve invalid pointer or memory access leading to crash or corruption

How to detect it

Review kernel logs and RDMA subsystem traces for unexpected integer-related faults or invalid pointer accesses around uverbs command processing; correlate with process activity involving ib_uverbs or RDMA userspace libraries. No public exploitation artifacts are known.

What your security team should do

• Immediately update all Linux kernels on RDMA-enabled systems to the fixed commit
• Audit custom or out-of-tree RDMA drivers for similar unchecked multiplications
• Monitor EPSS and threat actor activity for any rise in exploitation of this class of issue
• Apply updates within normal patching cycles given absence from KEV