GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54168 (GCVE-0-2023-54168)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:08 – Updated: 2026-08-05 09:17
VLAI
Title
RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() The ucmd->log_sq_bb_count variable is controlled by the user so this shift can wrap. Fix it by using check_shl_overflow() in the same way that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()").
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 839041329fd3410e07d614f81e75bb43367d8f89 , < 3d5ae269c4bd392ec1edbfb3bd031b8f42d7feff (git)
Affected: 839041329fd3410e07d614f81e75bb43367d8f89 , < 8feca625900777e02a449e53fe4121339934c38a (git)
Affected: 839041329fd3410e07d614f81e75bb43367d8f89 , < 9ad3221c86cc9c6305594b742d4a72dfbd4ea579 (git)
Affected: 839041329fd3410e07d614f81e75bb43367d8f89 , < 9911be2155720221a4f1f722b22bd0e2388d8bcf (git)
Affected: 839041329fd3410e07d614f81e75bb43367d8f89 , < 3ce0df3493277b9df275cb8455d9c677ae701230 (git)
Affected: 839041329fd3410e07d614f81e75bb43367d8f89 , < 196a6df08b08699ace4ce70e1efcdd9081b6565f (git)
Affected: 839041329fd3410e07d614f81e75bb43367d8f89 , < a183905869e692b6b7805b7472235585eff8e429 (git)
Affected: 839041329fd3410e07d614f81e75bb43367d8f89 , < d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.24
Unaffected: 0 , < 2.6.24 (semver)
Unaffected: 4.19.283 , ≤ 4.19.* (semver)
Unaffected: 5.4.243 , ≤ 5.4.* (semver)
Unaffected: 5.10.180 , ≤ 5.10.* (semver)
Unaffected: 5.15.111 , ≤ 5.15.* (semver)
Unaffected: 6.1.28 , ≤ 6.1.* (semver)
Unaffected: 6.2.15 , ≤ 6.2.* (semver)
Unaffected: 6.3.2 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx4/qp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3d5ae269c4bd392ec1edbfb3bd031b8f42d7feff",
              "status": "affected",
              "version": "839041329fd3410e07d614f81e75bb43367d8f89",
              "versionType": "git"
            },
            {
              "lessThan": "8feca625900777e02a449e53fe4121339934c38a",
              "status": "affected",
              "version": "839041329fd3410e07d614f81e75bb43367d8f89",
              "versionType": "git"
            },
            {
              "lessThan": "9ad3221c86cc9c6305594b742d4a72dfbd4ea579",
              "status": "affected",
              "version": "839041329fd3410e07d614f81e75bb43367d8f89",
              "versionType": "git"
            },
            {
              "lessThan": "9911be2155720221a4f1f722b22bd0e2388d8bcf",
              "status": "affected",
              "version": "839041329fd3410e07d614f81e75bb43367d8f89",
              "versionType": "git"
            },
            {
              "lessThan": "3ce0df3493277b9df275cb8455d9c677ae701230",
              "status": "affected",
              "version": "839041329fd3410e07d614f81e75bb43367d8f89",
              "versionType": "git"
            },
            {
              "lessThan": "196a6df08b08699ace4ce70e1efcdd9081b6565f",
              "status": "affected",
              "version": "839041329fd3410e07d614f81e75bb43367d8f89",
              "versionType": "git"
            },
            {
              "lessThan": "a183905869e692b6b7805b7472235585eff8e429",
              "status": "affected",
              "version": "839041329fd3410e07d614f81e75bb43367d8f89",
              "versionType": "git"
            },
            {
              "lessThan": "d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb",
              "status": "affected",
              "version": "839041329fd3410e07d614f81e75bb43367d8f89",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx4/qp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.243",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.283",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.243",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.180",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.111",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.28",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.15",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.2",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx4: Prevent shift wrapping in set_user_sq_size()\n\nThe ucmd-\u003elog_sq_bb_count variable is controlled by the user so this\nshift can wrap.  Fix it by using check_shl_overflow() in the same way\nthat it was done in commit 515f60004ed9 (\"RDMA/hns: Prevent undefined\nbehavior in hns_roce_set_user_sq_size()\")."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled value arrives in the `mlx4_ib_create_qp` udata payload written to `/dev/infiniband/uverbsN`, a local character-device verb call. No remote peer or network packet participates in reaching `set_user_sq_size()`.\nAC:L - Triggering is fully deterministic \u2014 the attacker simply sets `log_sq_bb_count` to 31 (or 63/95/\u2026/255) in the create-QP command; no race, timing window, or memory-layout condition is involved, and the resulting QP context is programmed on every attempt.\nPR:L - No `capable()` or capability gate exists anywhere along `ib_uverbs_open` \u2192 `ib_uverbs_create_qp` \u2192 `create_qp_common`; access is controlled purely by the uverbs device node, which rdma-core\u0027s udev rules ship as mode 0666, so any unprivileged local account (including inside a container, since RDMA devices default to shared net-ns mode) can issue the malformed create-QP.\nUI:N - The whole sequence \u2014 create QP with the wrapped shift, then modify to INIT/RTR/RTS and ring the send doorbell \u2014 is driven entirely by the attacker\u0027s own process. No victim action is needed.\nS:U - The bypassed sanity check, the corrupted `mlx4_ib_qp` state, and the resulting device errors all remain under the host kernel\u0027s security authority; no hypervisor, IOMMU, or sandbox boundary is crossed by the defect itself.\nC:H - The bypass programs the QP context with a 2 MB send queue against an MTT allocation as small as one page, so the adapter translates send-WQE fetches through MTT entries belonging to other RDMA objects \u2014 including other processes\u0027 pinned registrations \u2014 yielding a large, unbounded out-of-bounds read at the DMA layer rather than a few stray bytes.\nI:H - The same out-of-range translation window lets the device act on work-queue entries fetched from memory outside the registered buffer, and `qp-\u003esq.wqe_cnt` becoming `INT_MIN` corrupts the QP context (spuriously setting the `sq_no_prefetch` bit and a maximal `log_sq_size`), giving attacker-induced modification of kernel and device state well beyond the QP\u0027s own resources.\nA:H - This re-exposes exactly the crash that commit 839041329fd3 added the check to prevent (\"arbitrarily large/small values \u2026 can crash the kernel\"); accesses beyond the mapped MTT produce local-access/QP-operation errors and can escalate to a catastrophic adapter error and `mlx4_catas_error()` reset, killing InfiniBand and Ethernet for every user of the ConnectX-3 NIC, and the shift itself panics a `CONFIG_UBSAN_SHIFT` + `panic_on_warn` kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:49.049Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3d5ae269c4bd392ec1edbfb3bd031b8f42d7feff"
        },
        {
          "url": "https://git.kernel.org/stable/c/8feca625900777e02a449e53fe4121339934c38a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ad3221c86cc9c6305594b742d4a72dfbd4ea579"
        },
        {
          "url": "https://git.kernel.org/stable/c/9911be2155720221a4f1f722b22bd0e2388d8bcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ce0df3493277b9df275cb8455d9c677ae701230"
        },
        {
          "url": "https://git.kernel.org/stable/c/196a6df08b08699ace4ce70e1efcdd9081b6565f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a183905869e692b6b7805b7472235585eff8e429"
        },
        {
          "url": "https://git.kernel.org/stable/c/d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb"
        }
      ],
      "title": "RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54168",
    "datePublished": "2025-12-30T12:08:43.394Z",
    "dateReserved": "2025-12-30T12:06:44.495Z",
    "dateUpdated": "2026-08-05T09:17:49.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54168",
      "date": "2026-09-18",
      "epss": "0.0015",
      "percentile": "0.04577"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/mlx4/qp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3d5ae269c4bd392ec1edbfb3bd031b8f42d7feff",
                    "status": "affected",
                    "version": "839041329fd3410e07d614f81e75bb43367d8f89",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8feca625900777e02a449e53fe4121339934c38a",
                    "status": "affected",
                    "version": "839041329fd3410e07d614f81e75bb43367d8f89",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9ad3221c86cc9c6305594b742d4a72dfbd4ea579",
                    "status": "affected",
                    "version": "839041329fd3410e07d614f81e75bb43367d8f89",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9911be2155720221a4f1f722b22bd0e2388d8bcf",
                    "status": "affected",
                    "version": "839041329fd3410e07d614f81e75bb43367d8f89",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3ce0df3493277b9df275cb8455d9c677ae701230",
                    "status": "affected",
                    "version": "839041329fd3410e07d614f81e75bb43367d8f89",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "196a6df08b08699ace4ce70e1efcdd9081b6565f",
                    "status": "affected",
                    "version": "839041329fd3410e07d614f81e75bb43367d8f89",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a183905869e692b6b7805b7472235585eff8e429",
                    "status": "affected",
                    "version": "839041329fd3410e07d614f81e75bb43367d8f89",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb",
                    "status": "affected",
                    "version": "839041329fd3410e07d614f81e75bb43367d8f89",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/mlx4/qp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.24"
                  },
                  {
                    "lessThan": "2.6.24",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.283",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.243",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.180",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.28",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.15",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.3.*",
                    "status": "unaffected",
                    "version": "6.3.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx4: Prevent shift wrapping in set_user_sq_size()\n\nThe ucmd-\u003elog_sq_bb_count variable is controlled by the user so this\nshift can wrap.  Fix it by using check_shl_overflow() in the same way\nthat it was done in commit 515f60004ed9 (\"RDMA/hns: Prevent undefined\nbehavior in hns_roce_set_user_sq_size()\")."
          }
        ],
        "id": "CVE-2023-54168",
        "lastModified": "2026-08-04T11:16:35.207",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-30T13:16:04.610",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/196a6df08b08699ace4ce70e1efcdd9081b6565f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3ce0df3493277b9df275cb8455d9c677ae701230"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3d5ae269c4bd392ec1edbfb3bd031b8f42d7feff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8feca625900777e02a449e53fe4121339934c38a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9911be2155720221a4f1f722b22bd0e2388d8bcf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9ad3221c86cc9c6305594b742d4a72dfbd4ea579"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a183905869e692b6b7805b7472235585eff8e429"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:14:44+00:00",
      "cve": "CVE-2023-54168",
      "id": "CVE-2023-54168",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54168.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-02T12:40:26Z",
      "cve": "CVE-2023-54168",
      "id": "CVE-2023-54168",
      "initial_release_date": "2025-12-31T00:29:24Z",
      "product_status:known_affected": "509",
      "product_status:known_not_affected": "206",
      "product_status:recommended": "252",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54168",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54168.json",
      "version": "27"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.