Vulnerability in Kernel: RDMA/rxe - Invalid lkey Supplied
Summary
GSD-2021-1000499: RDMA/rxe: Return CQE error if invalid lkey was supplied. Affects Kernel versions >= 8700e3e7c4857d28ebaa824509934556da0b3e76, < abe31d25facdb9109fe2cf69890748295291570c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and ensures the stability and security of the system. RDMA (Remote Direct Memory Access) is a protocol used for high-speed data transfer between remote systems. The RDMA/rxe module in the Kernel enables RDMA functionality over Ethernet networks. However, a vulnerability has been discovered in the RDMA/rxe module that allows the use of an invalid lkey (local key) during operations.
Vulnerability Detail
The vulnerability in the RDMA/rxe module occurs when an invalid lkey is supplied. An lkey is a local key that represents a specific memory region on the system. When an invalid lkey is used, it can lead to memory corruption, data leakage, or system crashes. An attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive information or disrupt the system's stability. The vulnerability was introduced in version 4.8 of the Kernel and has been fixed in version 5.12.7.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the RDMA/rxe module if it is not required for their system's functionality. This can be done by blacklisting the module or removing it from the Kernel configuration. However, disabling the module may impact the availability of RDMA functionality on the system.
Conclusion
The vulnerability in the RDMA/rxe module of the Kernel allows for the use of an invalid lkey, which can lead to memory corruption, data leakage, or system crashes. It is crucial to update the Kernel to version 5.12.7 or later to mitigate this vulnerability. Users can also consider disabling the RDMA/rxe module as a temporary workaround, but this may impact RDMA functionality. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The RDMA/rxe module in the Kernel enables RDMA functionality over Ethernet networks. It allows for high-speed data transfer between remote systems.
By supplying an invalid lkey, an attacker can potentially corrupt memory, leak sensitive data, or cause system crashes.
The vulnerability was introduced in version 4.8 of the Kernel. Versions prior to 5.12.7 are affected.
Yes, the vulnerability has been fixed in version 5.12.7 of the Kernel. Users should update their Kernel to this version or later.
Yes, as a temporary workaround, users can disable the RDMA/rxe module if it is not required for their system's functionality. However, this may impact the availability of RDMA functionality on the system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
