Riskcovery

CVE-2024-53094

RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES

State
Published
Severity
9.8 Critical
Published
Nov 21, 2024
Updated
Oct 30, 2026
Reserved
Nov 19, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES

While running ISER over SIW, the initiator machine encounters a warning from skb_splice_from_iter() indicating that a slab page is being used in send_page. To address this, it is better to add a sendpage_ok() check within the driver itself, and if it returns 0, then MSG_SPLICE_PAGES flag should be disabled before entering the network stack.

A similar issue has been discussed for NVMe in this thread: https://lore.kernel.org/all/20240530142417.146696-1-ofir.gal@volumez.com/

WARNING: CPU: 0 PID: 5342 at net/core/skbuff.c:7140 skb_splice_from_iter+0x173/0x320 Call Trace: tcp_sendmsg_locked+0x368/0xe40 siw_tx_hdt+0x695/0xa40 [siw] siw_qp_sq_process+0x102/0xb00 [siw] siw_sq_resume+0x39/0x110 [siw] siw_run_sq+0x74/0x160 [siw] kthread+0xd2/0x100 ret_from_fork+0x34/0x40 ret_from_fork_asm+0x1a/0x30

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0e935ae6afcdbe6f0c0aa457ae57feccc63bb9be to before d5a019e819a0f0457570416bb2eb5f3321f5be81Affected
  • 0e935ae6afcdbe6f0c0aa457ae57feccc63bb9be to before 3406bfc813a9bbd9c3055795e985f527b7852e8cAffected
  • 0e935ae6afcdbe6f0c0aa457ae57feccc63bb9be to before bb5738957d92c8603a90c9664d34236641c221b2Affected
  • 0e935ae6afcdbe6f0c0aa457ae57feccc63bb9be to before 4e1e3dd88a4cedd5ccc1a3fc3d71e03b70a7a791Affected
LinuxLinux
  • 5.3Affected
  • before 5.3Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.62 through 6.6.*Not affected
  • 6.11.9 through 6.11.*Not affected
  • 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.