Linux Kernel SMC-D CHID-0 Acceptance Vulnerability Leading to Null Pointer Dereference

A vulnerability in the Linux kernel's SMC-D client can lead to a null pointer dereference. This issue arises because slot 0 of the 'ism_dev' and 'ism_chid' arrays is reserved for SMC-Dv1 devices. When no V1 device is selected, slot 0 remains uninitialized, with 'ism_dev[0]' set to NULL and 'ism_chid[0]' at 0. The function 'smc_v2_determine_accepted_chid' matches the peer's CHID against this array, starting from index 0. If a malicious peer responds to an SMC-Dv2-only proposal with a CHID of 0, it will match the empty slot, causing 'ism_selected' to be set to 0. This leads to a dereference of 'ism_dev[0]->lgr_lock' in 'smc_conn_create', causing a fault due to the null pointer. The vulnerability has been fixed by ensuring that 'ism_dev[i]' is not NULL before accepting a CHID match.

Impact

Exploitation of this vulnerability causes a null pointer dereference, leading to a crash of the SMC-D client.

Reproduction

To reproduce this vulnerability, initiate an SMC-Dv2-only proposal and have a peer respond with a CHID of 0. This will trigger the vulnerability by matching the uninitialized slot 0, causing the client to crash due to the null pointer dereference.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.