Vulnerability in Kernel package: Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error"
Summary
GSD-2022-1001836: Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error". Affects Kernel versions >= 4c3c666ecc6a287f367c2e0b53fa2e48e548820d, < b089f7fc89f9a106c24bfc9d8f0bbf67df84fc3f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The RDMA (Remote Direct Memory Access) subsystem within the Kernel enables high-speed data transfers between remote systems. This vulnerability specifically affects the RDMA/core module of the Kernel package.
Vulnerability Detail
The vulnerability identified in the RDMA/core module of the Kernel package is related to the function 'ib_qp_usecnt_dec()' being called when an error occurs. This function is responsible for decrementing the usage count of a Queue Pair (QP) object. However, due to a coding error, the function is mistakenly invoked even when an error condition is encountered. This can lead to incorrect usage count calculations and potential memory corruption or other security issues. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the Kernel package's RDMA/core module, which resulted in the incorrect invocation of the 'ib_qp_usecnt_dec()' function during error conditions, has been identified. To mitigate this vulnerability, it is crucial to update the Kernel package to version v5.15.33 or later. No specific workaround has been provided. For more information and support, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is currently unknown. It is important to update to the fixed version of the Kernel package to mitigate any potential security risks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
No known exploits for this vulnerability have been reported at this time. However, it is still advisable to update to the fixed version of the Kernel package as a precautionary measure.
For more details about this vulnerability, you can refer to the source JSON file provided by the Cloud Security Alliance's GSD Database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1001xxx/GSD-2022-1001836.json
For further support and assistance with vulnerability remediation, you can reach out to info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
