Linux kernel InfiniBand uverbs drivers/infiniband/core/uverbs_cmd.c - ib_uverbs_poll_cq: Integer overflow on the

Impact

Integer overflow on the completion-queue poll path. A tenant passes an oversized entry count through the uverbs POLL_CQ command, the size computation wraps, and the kernel corrupts memory past the allocation - a heap-corruption primitive available to anyone holding the uverbs device node, with privilege escalation not excluded. Historically important because it is the first of the uverbs command-argument overflows and it establishes the pattern that CVE-2014-8159 and CVE-2016-8636 repeat: the verbs uAPI trusted tenant-supplied sizes.

Who can reach it

Local, unprivileged - read/write on /dev/infiniband/uverbsN, i.e. any RDMA-enabled tenant container.

What to do

Kernel upgrade past 2.6.37 or a vendor backport; rolling reboot. Any fleet still exposed to this is running a kernel a decade and a half old, so the operator decision is really a platform upgrade, not a patch. Interim control is the same as for the other uverbs bugs: stop mapping /dev/infiniband/uverbs* into untrusted workloads.

References