RDMA/mlx5: Initialize the ODP xarray when creating an ODP MR
Summary
GSD-2021-1002138: RDMA/mlx5: Initialize the ODP xarray when creating an ODP MR. Affects Kernel versions >= a639e66703ee45745dc4057c7c2013ed9e1963a7, < 5f6995295f65d1ee6f36d466d26afd98eb797afe. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The RDMA/mlx5 package is a component of the Linux Kernel that provides support for Remote Direct Memory Access (RDMA) over Mellanox ConnectX-4 and ConnectX-5 adapters. RDMA allows for high-speed, low-latency communication between remote systems. The mlx5 driver is responsible for managing these adapters and enabling RDMA functionality. One of the features provided by the mlx5 driver is the ability to create an ODP (On-Demand Paging) Memory Region (MR), which allows for efficient memory access in RDMA operations. However, a vulnerability exists in the mlx5 driver that can lead to uninitialized memory access when creating an ODP MR.
Vulnerability Detail
The vulnerability in RDMA/mlx5 occurs due to the failure to initialize the ODP xarray when creating an ODP MR. This can result in uninitialized memory being accessed, leading to potential security issues. An attacker may be able to exploit this vulnerability to read sensitive information or execute arbitrary code in the context of the affected system. The impact and attack plausibility of this vulnerability have not yet been proven, but it is important to address it to prevent potential security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in RDMA/mlx5 that allows uninitialized memory access when creating an ODP MR can have potential security implications. It is crucial to update the Linux Kernel to version v5.14.16 or later to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
RDMA/mlx5 is a component of the Linux Kernel that provides support for Remote Direct Memory Access (RDMA) over Mellanox ConnectX-4 and ConnectX-5 adapters. It enables high-speed, low-latency communication between remote systems.
An ODP (On-Demand Paging) Memory Region (MR) is a feature provided by the mlx5 driver in RDMA/mlx5. It allows for efficient memory access in RDMA operations.
The impact of this vulnerability is not yet proven, but it could potentially allow an attacker to read sensitive information or execute arbitrary code in the context of the affected system.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.14.16 or later, which includes the necessary fix for this issue.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
