CVE-2024-40992: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-40992 affects the Linux kernel's RDMA/rxe (Remote Direct Memory Access/RXE) subsystem. The vulnerability was discovered in the responder length checking functionality for UD (Unreliable Datagram) request packets. According to the IBA specification, when a UD request packet with an invalid length is detected, it should be silently dropped by the responder, which then waits for a new request packet (Kernel Git).

The vulnerability stems from a regression issue introduced by commit 689c5421bfe0 which defers responder length check for UD QPs in the copy_data function. When the packet size is too large to fit in the receive buffer, copy_data returns error code -EINVAL, causing send_data_in to return RESPST_ERR_MALFORMED_WQE, which incorrectly transitions the UD QP into an ERROR state instead of silently dropping the packet (Kernel Git). The vulnerability has been assigned a CVSS v3.1 score of 4.4 with vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (Red Hat).

When exploited, this vulnerability can cause the UD QP (Queue Pair) to incorrectly transition into an ERROR state instead of properly handling invalid packet lengths, potentially affecting the reliability and availability of RDMA communications (Kernel Git).

The vulnerability requires local access with high privileges to exploit, as indicated by the CVSS metrics. The attack complexity is low, but privileged access is required, and no user interaction is needed (Red Hat).

The vulnerability has been fixed in Linux kernel versions 6.6.36, 6.9.7, and 6.10-rc5. Red Hat Enterprise Linux 9 has deferred the fix for both kernel and kernel-rt packages (Red Hat).