Vulnerability in xprtrdma Package: Treat All Calls as Not a bcall when bc_serv is NULL
Summary
GSD-2022-1003948: xprtrdma: treat all calls not a bcall when bc_serv is NULL. Affects Kernel versions < 8e3943c50764dc7c5f25911970c3ff062ec1f18c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xprtrdma package is a component of the Linux Kernel. It provides support for Remote Direct Memory Access (RDMA) over RPC (Remote Procedure Call). RDMA allows for high-speed data transfers between remote systems without involving the CPU. The xprtrdma package enables RDMA functionality for RPC calls in the Linux Kernel.
Vulnerability Detail
The vulnerability in the xprtrdma package arises when it fails to treat all calls as not a bcall (back-channel call) when bc_serv (back-channel service) is NULL. This flaw can potentially be exploited by an attacker to execute arbitrary code or trigger a denial-of-service condition. The vulnerability has been assigned the ID GSD-2022-1003948. It is important to note that the impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The xprtrdma package in the Linux Kernel is vulnerable to a flaw that can potentially lead to arbitrary code execution or denial-of-service. It is crucial to update the Linux Kernel to version v4.14.283 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The xprtrdma package is a component of the Linux Kernel that enables Remote Direct Memory Access (RDMA) over RPC functionality.
The impact of this vulnerability is not yet proven, but it has the potential to allow arbitrary code execution or trigger a denial-of-service condition.
Yes, this vulnerability has been fixed in Linux Kernel version v4.14.283 by commit 8e3943c50764dc7c5f25911970c3ff062ec1f18c.
To update the Linux Kernel, you can pull the latest changes from the official Linux Kernel repository and rebuild the kernel. Detailed instructions can be found in the Linux Kernel documentation.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
