CVE-2023-52474

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests

hfi1 user SDMA request processing has two bugs that can cause data

corruption for user SDMA requests that have multiple payload iovecs

where an iovec other than the tail iovec does not run up to the page

boundary for the buffer pointed to by that iovec.a

Here are the specific bugs:

1. user_sdma_txadd() does not use struct user_sdma_iovec->iov.iov_len.

Rather, user_sdma_txadd() will add up to PAGE_SIZE bytes from iovec

to the packet, even if some of those bytes are past

iovec->iov.iov_len and are thus not intended to be in the packet.

2. user_sdma_txadd() and user_sdma_send_pkts() fail to advance to the

next iovec in user_sdma_request->iovs when the current iovec

is not PAGE_SIZE and does not contain enough data to complete the

packet. The transmitted packet will contain the wrong data from the

iovec pages.

This has not been

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References