CVE-2024-57935

What it actually does

Invalid/unattached dip_ctx pointer dereference during QP destruction after a failed modify-to-RTR operation, resulting in memory corruption or invalid access in the RDMA/hns driver.

Why it matters to the business

Kernel instability, crashes, or potential privilege escalation on Linux systems using Huawei RDMA hardware; low exploitability but high impact on affected clusters or storage fabrics.

How an attack unfolds

An attacker triggers a QP modify-to-RTR failure so that dip_ctx is never attached, then destroys the QP to force access to the dangling pointer, leading to out-of-bounds or invalid memory operations.

How to fix it

Update the Linux kernel to a version containing commit adc218676eef25575469234709c2d87185ca223a; rebuild and reboot affected systems.

How to confirm the fix worked

Verify kernel source contains the referenced commit or confirm the fixed version string after upgrade; test QP creation/modify/destroy paths on hns hardware.

Typical attack path

1. Create and partially configure an RDMA QP via hns driver
2. Force a modify-QP-to-RTR failure
3. Destroy the QP to trigger invalid dip_ctx access
4. Leverage resulting memory corruption for further exploitation

How to detect it

Review kernel logs for oops, panic, or invalid pointer dereference messages referencing hns, RDMA QP destroy, or dip_ctx; correlate with RDMA application activity.

What your security team should do

• Prioritize kernel upgrade on all systems exposing RDMA/hns interfaces
• Monitor for kernel oops/panics involving hns or dip_ctx
• Apply compensating controls such as disabling unused RDMA devices until patched