In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix undefined shift of user RQ WQE size
set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on
the user-provided rq_wqe_shift, which is only checked to be greater than
32, so shifts of 32 are still accepted. A shift of 31 also overflows a
signed integer, leading to undefined behavior.
Use check_shl_overflow() to compute the RQ WQE size and reject any
invalid values.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 8
https://git.kernel.org/stable/c/42f3d2c8c18b92ea33e506a38b64f1a8986c2823
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4b87a2497276a72fd63028e7419abf0fb7ed837b
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6fc874fdfb366bfb11c62e6af9a831c8be59ddda
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9fff54929cc00849d738faa99f06c32399aeb026
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b732db02a2b04cde393638df19de6251ce62a74e
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b746f949c2ac2b041102836095d6d4a2ef21fa75
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c1dbf52d24a8cb1aa56780ba51b72e7d495f258c
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d881d60223aac8fdc12b227d89c76e131e92a9cd
416baaa9-dc9f-4396-8d5f-8c081fb06d67