Linux kernel mlx4_ib (legacy ConnectX-3 RDMA): Same class of bug on the older mlx4 stack: the user-supplied

CVE-2023-54168Firmware, BMC & network fabricRDMA/mlx4 prevent shift wrapping in set_user_sq_size()curated

Impact

Same class of bug on the older mlx4 stack: the user-supplied log_sq_bb_count shift wraps in set_user_sq_size(). Any tenant with RDMA access on a ConnectX-3-era host gets a user-controlled shift into kernel sizing logic. Matters for operators still running legacy mlx4 nodes alongside a modern fleet.

Who can reach it

Local, low-privileged process creating an RDMA queue pair on an mlx4 device.

What to do

Upgrade the host kernel to 6.4 or a stable backport (4.19.283, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2). Host reboot. Strategically, this is a prompt to retire remaining ConnectX-3/mlx4 hardware rather than keep patching it.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-54168 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54168.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.