CVE-2022-50543
Description
A double-free vulnerability was found in the Linux kernel RDMA RXE (soft-RoCE) driver's memory region handling. A local user with access to RDMA userspace verbs can register a memory region with parameters that cause initialization to fail, triggering error handling code that frees the mr->map structure twice, which leads to memory corruption and can result in denial of service via kernel crash or potentially privilege escalation through heap manipulation.
Statement
The issue arises because of incorrect error handling in the memory region registration path. When rxe_reg_user_mr() calls rxe_mr_init_user() and initialization fails, the error path frees the mr->map structure. However, the cleanup then calls rxe_mr_cleanup() through __rxe_cleanup(), which attempts to free mr->map again, resulting in a double-free. This vulnerability was introduced when a previous fix for duplicate mapping tables was reverted, inadvertently reintroducing the double-free condition. Under normal circumstances, a local user with permissions to use RDMA verbs (typically requiring membership in the rdma group or CAP_IPC_LOCK capability) can trigger this by registering user memory regions with specific parameters that cause initialization failure. Double-free vulnerabilities are well-known memory corruption primitives; while direct exploitation for privilege escalation requires understanding kernel heap layout, they provide attackers with a foundation for more sophisticated attacks beyond simple denial of service.
Mitigation
To mitigate this issue, prevent the rdma_rxe module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | 7.8 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | High | High |
| Integrity Impact | High | High | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: DoS: Crash, Exit, or Restart
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
