Vulnerability in xprtrdma Package: Treat All Calls as Not a bcall When bc_serv is NULL

Background

The xprtrdma package is a component of the Linux Kernel ecosystem. It provides support for the Remote Direct Memory Access (RDMA) protocol in the kernel's RPC (Remote Procedure Call) layer. RDMA allows for efficient data transfer between remote systems without involving the CPU. The xprtrdma package enables RDMA functionality for RPC calls in the kernel.

This vulnerability affects the xprtrdma package when the bc_serv (backchannel service) is NULL. The bc_serv is responsible for handling backchannel RPC calls, which are used for server-initiated communication. When bc_serv is NULL, all calls are incorrectly treated as not a backchannel call, potentially leading to security issues.

Vulnerability Detail

The vulnerability arises from the incorrect handling of RPC calls in the xprtrdma package when the bc_serv is NULL. This causes all calls to be treated as not a backchannel call, regardless of their actual nature. As a result, certain security measures and checks specific to backchannel calls may be bypassed, potentially leading to unauthorized access or other security breaches.

The impact and attack plausibility of this vulnerability have not been proven yet, but it is important to address it to ensure the integrity and security of systems utilizing the xprtrdma package.

Workaround

As a workaround, users can apply the patch manually by identifying the affected code and modifying it accordingly. However, it is strongly advised to update to the latest version of the Linux Kernel to ensure comprehensive vulnerability mitigation.

Here is an example of the code modification that addresses the vulnerability:

// Original code
if (bc_serv == NULL) {
    // Treat all calls as not a bcall
}

// Modified code
if (bc_serv == NULL || !call->cl_bc_xprt) {
    // Treat all calls as not a bcall
}

Conclusion

The xprtrdma package in the Linux Kernel is vulnerable to a security issue where all calls are incorrectly treated as not a backchannel call when the bc_serv is NULL. This vulnerability could potentially lead to unauthorized access or other security breaches. To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.18.4 or later. Alternatively, users can apply the provided workaround, but updating to the latest version is strongly advised. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for Kernel →

FAQ