Linux kernel - RDMA/rxe unreliable datagram responder, drivers/infiniband/sw/rxe/rxe_resp.c: FABRIC DOS: The IB

Impact

FABRIC DOS: The IB architecture says a UD request packet with an invalid length must be silently dropped, but a regression made rxe return a malformed-WQE error that pushes the UD queue pair into the ERROR state instead. A remote sender only has to transmit one oversized UD packet to permanently break the victim's UD queue pair. UD queue pairs carry management traffic and are used by MPI and by connection establishment, so killing them takes the node out of collective communication - the job stalls rather than fails cleanly, which is the expensive failure mode on a large training run.

Who can reach it

Send a UD packet whose payload is larger than the receiver's posted receive buffer. Unauthenticated, connectionless by definition (UD), reachable from anywhere on the fabric that can address the victim's QP. No exploit primitive needed - just a packet that is too big.

What to do

Host reboot / kernel upgrade. Where rxe is not needed - the common case on clusters with real RNICs - unload and blacklist rdma_rxe instead (config change, no downtime). This one is a stability item as much as a security item: it also fires accidentally under MTU mismatches, so fixing it removes a class of unexplained job hangs.

References