In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: fix integer overflow in immediate data length check
imm_buf->len is a user-controlled uint32_t received from the network.
Adding it to imm_data_offset without overflow checking allows a
malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap
around to a small value, bypassing the bounds check, and subsequently
passing a ~4GB length to sg_init_one().
Use check_add_overflow() to detect wrapping before the comparison.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - SRPT is an in-kernel SCSI RDMA target reached by remote initiators over InfiniBand/RoCE via RDMA/IB CM; malicious SRP_CMD IUs are delivered through srpt_recv_done() without any local syscall or physical access.
AC:L - Once connected on an immediate-data SRPT target (use_srq=0), a malicious initiator deterministically sets imm_buf->len=0xFFFFFFFF to wrap req_size and bypass checks; no race or attacker-uncontrollable condition is required.
PR:N - SRPT enables LIO demo mode (srpt_check_true), so any remote initiator that completes SRP login on an enabled target gets a dynamic ACL without target-local credentials, root, or CAP_NET_ADMIN on the victim host.
UI:N - Exploitation requires only attacker-initiated RDMA connection, SRP login, and crafted SRP_CMD traffic; no administrator or other user must mount storage or perform any action on the target.
S:U - The integer overflow corrupts kernel heap memory and SCSI-target processing within the host kernel's own security authority; it does not cross VM, IOMMU, or container sandbox boundaries.
C:H - Passing a ~4GB length to sg_init_one() on a small receive buffer creates a massive out-of-bounds scatterlist; subsequent target-core DMA/map operations can read far beyond the buffer, enabling arbitrary kernel memory disclosure.
I:H - The bogus scatterlist gives the block/SCSI target path an attacker-controlled ~4GB kernel memory write/read primitive over adjacent heap objects, exploitable for control-flow hijacking and privilege escalation.
A:H - Out-of-bounds access from a ~4GB scatterlist on a kilobyte-scale receive buffer readily triggers kernel oops, KASAN faults, or panic, denying availability even before full exploitation.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - SRPT is an in-kernel SCSI RDMA target reached by remote initiators over InfiniBand/RoCE via RDMA/IB CM; malicious SRP_CMD IUs are delivered through srpt_recv_done() without any local syscall or physical access.
AC:L - Once connected on an immediate-data SRPT target (use_srq=0), a malicious initiator deterministically sets imm_buf->len=0xFFFFFFFF to wrap req_size and bypass checks; no race or attacker-uncontrollable condition is required.
PR:N - SRPT enables LIO demo mode (srpt_check_true), so any remote initiator that completes SRP login on an enabled target gets a dynamic ACL without target-local credentials, root, or CAP_NET_ADMIN on the victim host.
UI:N - Exploitation requires only attacker-initiated RDMA connection, SRP login, and crafted SRP_CMD traffic; no administrator or other user must mount storage or perform any action on the target.
S:U - The integer overflow corrupts kernel heap memory and SCSI-target processing within the host kernel's own security authority; it does not cross VM, IOMMU, or container sandbox boundaries.
C:H - Passing a ~4GB length to sg_init_one() on a small receive buffer creates a massive out-of-bounds scatterlist; subsequent target-core DMA/map operations can read far beyond the buffer, enabling arbitrary kernel memory disclosure.
I:H - The bogus scatterlist gives the block/SCSI target path an attacker-controlled ~4GB kernel memory write/read primitive over adjacent heap objects, exploitable for control-flow hijacking and privilege escalation.
A:H - Out-of-bounds access from a ~4GB scatterlist on a kilobyte-scale receive buffer readily triggers kernel oops, KASAN faults, or panic, denying availability even before full exploitation.
CVSS 3.1