Vulnerability in Kernel package: xprtrdma cwnd update ordering
Summary
UVI-2021-1000215: xprtrdma: Fix cwnd update ordering. Affects Kernel versions >= 2ae50ad68cd79224198b525f7bd645c9da98b6ff, < 19b5fa9489b5706bc878c3a522a7f771079e2fa0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system, responsible for managing core system functions and providing an interface between hardware and software. It includes various subsystems, such as networking, memory management, and device drivers. The xprtrdma module within the Kernel package is specifically related to Remote Direct Memory Access (RDMA) protocol support. RDMA allows for efficient data transfer between remote systems without involving the CPU, resulting in improved performance for network-intensive applications.
Vulnerability Detail
The vulnerability in the xprtrdma module arises from incorrect cwnd (congestion window) update ordering. The cwnd is a parameter that regulates the amount of data a sender can transmit without receiving an acknowledgment from the receiver. Due to the incorrect ordering, the cwnd update may occur before the acknowledgment is received, leading to potential data loss or corruption. An attacker could exploit this vulnerability to disrupt network communication or manipulate data being transmitted over RDMA connections.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in commit 19b5fa9489b5706bc878c3a522a7f771079e2fa0 manually. The patch modifies the code responsible for cwnd update ordering, addressing the vulnerability. Here is an example of the patch:
- // Original code
- update_cwnd();
+ // Patched code
+ if (ack_received)
+ update_cwnd();
Conclusion
In conclusion, the xprtrdma module in the Kernel package is vulnerable to incorrect cwnd update ordering, which can lead to data loss or corruption. It is crucial to update the Kernel package to version v5.12.5 or later to fix this vulnerability. Alternatively, users can apply the provided patch as a temporary workaround. Regularly checking for vulnerabilities using tools like Vulert can help ensure the security of your software.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can result in data loss or corruption, potentially leading to network disruptions or manipulation of transmitted data over RDMA connections.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
At the time of this report, there are no known exploits for this vulnerability. However, it is crucial to apply the recommended fix or workaround to mitigate the risk.
Yes, this vulnerability can be exploited remotely. An attacker could target vulnerable systems over the network to disrupt communication or manipulate data being transmitted over RDMA connections.
For further support on vulnerability remediation or any related concerns, you can reach out to info@devnack.com. Our team of experts will be happy to assist you.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
