Vulnerability in RDMA/cma affecting Kernel
Summary
GSD-2022-1000848: RDMA/cma: Do not change route.addr.src_addr outside state checks. Affects Kernel versions >= 732d41c545bb359cbb8c94698bdc1f8bcf82279c, < 5b1cef5798b4fd6e4fd5522e7b8a26248beeacaa. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionalities and drivers for various devices. RDMA (Remote Direct Memory Access) is a protocol that allows direct memory access from the memory of one computer to the memory of another computer without involving the operating system. RDMA/cma (RDMA Connection Manager) is a component of the Kernel that handles connection management for RDMA devices. It provides APIs for establishing and managing RDMA connections.
Vulnerability Detail
The vulnerability in RDMA/cma involves changing the route.addr.src_addr outside of state checks. This vulnerability allows an attacker to manipulate the source address of RDMA connections, potentially leading to unauthorized access, data leakage, or denial of service. The vulnerability was introduced in version v5.10 of the Linux Kernel and was fixed in version v5.10.103. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in RDMA/cma affecting the Kernel can potentially lead to unauthorized access, data leakage, or denial of service. It is crucial to update the Linux Kernel to version v5.10.103 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
RDMA/cma (RDMA Connection Manager) is a component of the Linux Kernel that handles connection management for RDMA devices. It provides APIs for establishing and managing RDMA connections.
The impact of this vulnerability could potentially include unauthorized access, data leakage, or denial of service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you if the vulnerability is present.
Yes, the vulnerability has been fixed in Linux Kernel version v5.10.103. It is recommended to update your Kernel to this version or later.
You can find more information about this vulnerability in the GSD database entry: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000848.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
