RDMA/rxe: Clear all QP fields if creation failed
Summary
GSD-2021-1000519: RDMA/rxe: Clear all QP fields if creation failed. Affects Kernel versions >= 8700e3e7c4857d28ebaa824509934556da0b3e76, < 6a8086a42dfbf548a42bf2ae4faa291645c72c66. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The RDMA/rxe package is a component of the Linux Kernel that provides support for Remote Direct Memory Access (RDMA) over Ethernet. RDMA allows for high-speed, low-latency data transfers between remote systems. The rxe package specifically implements the RDMA transport layer over Ethernet. It provides the necessary functionality for creating and managing Queue Pairs (QPs), which are used for communication between RDMA endpoints. QPs contain various fields that need to be properly initialized for successful operation.
Vulnerability Detail
The vulnerability identified as GSD-2021-1000519 in the RDMA/rxe package occurs when the creation of a QP fails. In this scenario, not all of the QP fields are properly cleared, potentially leaving sensitive information or uninitialized data in memory. An attacker could exploit this vulnerability to gain unauthorized access to the system or cause a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The RDMA/rxe package in the Linux Kernel is vulnerable to a potential security issue where not all QP fields are properly cleared if the creation of a QP fails. This vulnerability has been fixed in Linux Kernel version v4.14.234. It is recommended to update the affected Linux Kernel version to v4.14.234 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
RDMA stands for Remote Direct Memory Access. It is a technology that allows for high-speed, low-latency data transfers between remote systems.
A Queue Pair (QP) is a data structure used for communication between RDMA endpoints. It contains various fields that need to be properly initialized for successful operation.
The impact of this vulnerability is not yet proven. However, it could potentially allow an attacker to gain unauthorized access to the system or cause a denial-of-service (DoS) condition.
To fix this vulnerability, it is recommended to update the affected Linux Kernel version to v4.14.234 or later.
You can find more information about this vulnerability in the GSD-2021-1000519 entry of the GSD database.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
