Vulnerability in RDMA/rxe Package: Clear all QP fields if creation failed
Summary
GSD-2021-1000512: RDMA/rxe: Clear all QP fields if creation failed. Affects Kernel versions >= 8700e3e7c4857d28ebaa824509934556da0b3e76, < 2ee4d79c364914989c80de382c0b1a7259a7e4b3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The RDMA/rxe package is a component of the Linux Kernel that provides support for Remote Direct Memory Access (RDMA) over Ethernet. RDMA allows for high-speed data transfers between remote systems with low latency and CPU overhead. The rxe driver in the RDMA package is responsible for managing RDMA Queue Pairs (QPs), which are used for communication between RDMA endpoints. QPs contain various fields that need to be properly initialized for successful operation.
Vulnerability Detail
The vulnerability in the RDMA/rxe package occurs when the creation of a QP fails. In such cases, not all QP fields are properly cleared, potentially leaving sensitive information or uninitialized data in memory. This vulnerability could be exploited by an attacker to gain unauthorized access to sensitive information or to cause a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the RDMA/rxe package could potentially lead to unauthorized access to sensitive information or a denial-of-service (DoS) condition. It is recommended to update the Linux Kernel to version v5.10.40 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
RDMA stands for Remote Direct Memory Access. It is a technology that allows for high-speed data transfers between remote systems with low latency and CPU overhead.
A QP (Queue Pair) in RDMA is a communication channel between RDMA endpoints. It contains various fields that need to be properly initialized for successful operation.
The impact of this vulnerability could be unauthorized access to sensitive information or a denial-of-service (DoS) condition.
To fix this vulnerability, update your Linux Kernel to version v5.10.40 or later.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
