Vulnerability in RDMA/cma Package: Do not change route.addr.src_addr outside state checks
Summary
GSD-2022-1000726: RDMA/cma: Do not change route.addr.src_addr outside state checks. Affects Kernel versions >= 732d41c545bb359cbb8c94698bdc1f8bcf82279c, < d350724795c7a48b05bf921d94699fbfecf7da0b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The RDMA/cma package is a component of the Linux Kernel that provides support for Remote Direct Memory Access (RDMA) and Connection Manager Administration (CMA) functionality. RDMA allows for high-speed data transfer between remote systems, while CMA manages the establishment and maintenance of RDMA connections. This vulnerability affects the package's handling of route.addr.src_addr, which is used to specify the source address for RDMA connections. The vulnerability arises when route.addr.src_addr is modified outside of the appropriate state checks, potentially leading to security issues.
Vulnerability Detail
The vulnerability in the RDMA/cma package involves the improper modification of route.addr.src_addr outside of the necessary state checks. This can result in security vulnerabilities, although the exact impact and likelihood of successful exploitation have not been proven. The vulnerability was introduced in version v5.10 of the Linux Kernel by commit 732d41c545bb359cbb8c94698bdc1f8bcf82279c and has been fixed in version v5.16.12 by commit d350724795c7a48b05bf921d94699fbfecf7da0b. For more detailed information, please refer to the provided references.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the RDMA/cma package in the Linux Kernel is vulnerable to a security issue involving the improper modification of route.addr.src_addr outside of the necessary state checks. To mitigate this vulnerability, it is crucial to update the Linux Kernel to version v5.16.12 or later. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The RDMA/cma package is a component of the Linux Kernel that provides support for Remote Direct Memory Access (RDMA) and Connection Manager Administration (CMA) functionality. It allows for high-speed data transfer between remote systems and manages the establishment and maintenance of RDMA connections.
The exact impact of this vulnerability has not been proven, but it has the potential to introduce security vulnerabilities. Exploitation of the vulnerability could lead to unauthorized access or other security breaches.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.16.12 or later. This can be done by pulling the latest version from the official Linux Kernel repository and following the standard procedures for building and installing the Linux Kernel on your system.
No specific workaround has been provided for this vulnerability. It is recommended to update to the fixed version of the Linux Kernel as soon as possible.
For more detailed information about this vulnerability, including the specific commits that introduced and fixed it, please refer to the provided references.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
