Vulnerability in Kernel package: RDMA/core: Set send and receive CQ before forwarding to the driver
Summary
UVI-2021-1002322: RDMA/core: Set send and receive CQ before forwarding to the driver. Affects Kernel versions >= 514aee660df493cd673154a6ba6bab745ec47b8c, < b70e072feffa0ba5c41a99b9524b9878dee7748e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is an essential component of the Linux operating system, responsible for managing core functionalities and providing an interface between hardware and software. It includes various subsystems, such as networking, memory management, and device drivers. The RDMA (Remote Direct Memory Access) subsystem within the Kernel enables high-speed data transfer between remote systems. However, a vulnerability has been identified in the RDMA/core component, which can potentially lead to security issues.
Vulnerability Detail
The vulnerability in RDMA/core arises from the failure to set the send and receive Completion Queues (CQ) before forwarding them to the driver. This oversight can result in various security risks, although the exact impact and likelihood of exploitation have not been confirmed. The vulnerability was introduced in version v5.15 of the Linux Kernel by commit 514aee660df493cd673154a6ba6bab745ec47b8c and has been fixed in version v5.15.5 by commit b70e072feffa0ba5c41a99b9524b9878dee7748e.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel package's RDMA/core component can pose potential security risks. It is crucial to update the Linux Kernel to the fixed version v5.15.5 or later to mitigate these risks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a critical component of the Linux operating system, responsible for managing core functionalities and providing an interface between hardware and software.
RDMA/core is a subsystem within the Kernel that enables high-speed data transfer between remote systems using Remote Direct Memory Access technology.
A Completion Queue (CQ) is a data structure used in RDMA to track the completion of data transfer operations.
The exact impact and attack plausibility of this vulnerability have not been proven. However, it could potentially lead to security breaches or unauthorized access to sensitive data.
To fix this vulnerability, it is recommended to update the Linux Kernel package to version v5.15.5 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
