Linux Kernel RDMA/uverbs Integer Overflow Vulnerability

An integer overflow vulnerability has been identified in the Linux kernel's RDMA/uverbs component. This issue arises from user-supplied values in the 'cmd.wqe_size' and 'cmd.wr_count' variables, where their multiplication can lead to integer wrapping. The resulting value is then passed to 'uverbs_request_next_ptr()', which could also be susceptible to wrapping. Additionally, on 32-bit systems, the multiplication of 'cmd.sge_count' and 'sizeof(struct ib_uverbs_sge)' can overflow, although this is not a concern on 64-bit systems.

Impact

Exploitation of this vulnerability could lead to memory corruption issues, allowing for potential arbitrary code execution or causing a denial-of-service condition.

Remediation

Users can apply the latest patches available in the Linux kernel's official repository to address this vulnerability.