siw FragmentedHdr OOB

Vulnerability analysis

The software iWARP receive path processes extended DDP/RDMAP headers that may arrive fragmented across multiple TCP callbacks. When calculating how many bytes to copy for the remaining header fragment, the code uses a fixed offset rather than the number of bytes already received, so the copy can exceed the header buffer and overwrite adjacent receive state. A later callback then interprets the corrupted state as a copy offset, producing an out-of-bounds write into kernel memory. The fix bounds the copy length by the actual number of header bytes still missing, preventing the overflow. Any attacker who can send data over a TCP connection to a system with the siw driver loaded and an active RDMA endpoint can trigger this — no local account or privileges are required.