{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-40990",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-40990"
  ],
  "published": "2024-07-12T12:38:02Z",
  "summary": "RDMA/mlx5: Add check for srq max_sge attribute",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Add check for srq max_sge attribute\n\nmax_sge attribute is passed by the user, and is inserted and used\nunchecked, so verify that the value doesn't exceed maximum allowed value\nbefore using it.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.96",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40990"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7186b81c1f15e39069b1af172c6a951728ed3511"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1e692244bf7dd827dd72edc6c4a3b36ae572f03c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/999586418600b4b3b93c2a0edd3a4ca71ee759bf"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/e0deb0e9c967b61420235f7f17a4450b4b4d6ce2"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4ab99e3613139f026d2d8ba954819e2876120ab3"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/36ab7ada64caf08f10ee5a114d39964d1f91e81d"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerable code is reached only through the local uverbs character device `/dev/infiniband/uverbsN` via the CREATE_SRQ/CREATE_XSRQ ioctl-style command; there is no path from a remote RDMA peer or network packet into `mlx5_ib_create_srq()` with an attacker-chosen `max_sge`.\nAC:L - The attacker fully controls `max_sge` (a raw `__u32` copied from the uverbs command with no core-layer validation) and `max_wr`, so the oversized `desc_size`/`wqe_shift`, the truncated firmware `log_rq_stride` field, and the undersized PAS computation are produced deterministically on the first attempt with no race or layout dependency.\nPR:L - `uverbs_devnode()` makes `/dev/infiniband/uverbs*` mode 0666 in the kernel itself, and allocating a PD plus creating an SRQ requires no capability (only a non-zero default `RLIMIT_MEMLOCK` for `ib_umem_get()`), so any unprivileged local user \u2014 including one inside a container with the RDMA device exposed \u2014 can trigger it.\nUI:N - The attacker performs the entire sequence (open uverbs device, alloc PD, create SRQ) itself; no action by any other user or administrator is needed.\nS:U - The corruption and its consequences are confined to the kernel's own security authority on the same host; no VM, IOMMU, or sandbox boundary is crossed by the flaw itself.\nC:H - The unchecked value undersizes the `kvzalloc()`'d CREATE_SRQ mailbox and its PAS array while `mlx5_ib_populate_pas()` is bounded only by the umem block count, and it desynchronizes the firmware's WQ geometry from the kernel's \u2014 memory corruption of this kind is leverageable for kernel heap disclosure, and on branches lacking the `WARN_ON` guard the device is handed a truncated physical-address list to DMA against.\nI:H - The same undersized-PAS / out-of-bounds descriptor-write condition yields a kernel heap write primitive, and the truncated `log_rq_stride`/`log_wq_stride` firmware fields let the NIC operate on a work queue whose stride and extent disagree with the memory actually registered for it, giving attacker-influenced writes.\nA:H - The path reliably produces a user-triggerable `WARN_ON()` in `__set_srq_page_size()` and a shift-out-of-bounds in `get_pas_size()` (kernel panic under `panic_on_warn` or UBSAN trap), and feeding the ConnectX firmware an inconsistent WQ geometry can drive the device into a fatal/health-recovery state that takes down all traffic on the adapter."
    }
  }
}