linux-cve-announce - CVE-2023-54168: RDMA/mlx4: Prevent shift wrapping in set_user_sq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025123020-CVE-2023-54168-eba2@gregkh>
Date: Tue, 30 Dec 2025 13:09:36 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-54168: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()

The ucmd->log_sq_bb_count variable is controlled by the user so this
shift can wrap.  Fix it by using check_shl_overflow() in the same way
that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined
behavior in hns_roce_set_user_sq_size()").

The Linux kernel CVE team has assigned CVE-2023-54168 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.24 with commit 839041329fd3410e07d614f81e75bb43367d8f89 and fixed in 4.19.283 with commit 3d5ae269c4bd392ec1edbfb3bd031b8f42d7feff
	Issue introduced in 2.6.24 with commit 839041329fd3410e07d614f81e75bb43367d8f89 and fixed in 5.4.243 with commit 8feca625900777e02a449e53fe4121339934c38a
	Issue introduced in 2.6.24 with commit 839041329fd3410e07d614f81e75bb43367d8f89 and fixed in 5.10.180 with commit 9ad3221c86cc9c6305594b742d4a72dfbd4ea579
	Issue introduced in 2.6.24 with commit 839041329fd3410e07d614f81e75bb43367d8f89 and fixed in 5.15.111 with commit 9911be2155720221a4f1f722b22bd0e2388d8bcf
	Issue introduced in 2.6.24 with commit 839041329fd3410e07d614f81e75bb43367d8f89 and fixed in 6.1.28 with commit 3ce0df3493277b9df275cb8455d9c677ae701230
	Issue introduced in 2.6.24 with commit 839041329fd3410e07d614f81e75bb43367d8f89 and fixed in 6.2.15 with commit 196a6df08b08699ace4ce70e1efcdd9081b6565f
	Issue introduced in 2.6.24 with commit 839041329fd3410e07d614f81e75bb43367d8f89 and fixed in 6.3.2 with commit a183905869e692b6b7805b7472235585eff8e429
	Issue introduced in 2.6.24 with commit 839041329fd3410e07d614f81e75bb43367d8f89 and fixed in 6.4 with commit d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-54168
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/infiniband/hw/mlx4/qp.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3d5ae269c4bd392ec1edbfb3bd031b8f42d7feff
	https://git.kernel.org/stable/c/8feca625900777e02a449e53fe4121339934c38a
	https://git.kernel.org/stable/c/9ad3221c86cc9c6305594b742d4a72dfbd4ea579
	https://git.kernel.org/stable/c/9911be2155720221a4f1f722b22bd0e2388d8bcf
	https://git.kernel.org/stable/c/3ce0df3493277b9df275cb8455d9c677ae701230
	https://git.kernel.org/stable/c/196a6df08b08699ace4ce70e1efcdd9081b6565f
	https://git.kernel.org/stable/c/a183905869e692b6b7805b7472235585eff8e429
	https://git.kernel.org/stable/c/d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb