Executive Summary

This vulnerability exists in the Linux kernel's RDMA/uverbs component, specifically in the function ib_uverbs_post_send(). The function uses a value called wqe_size, provided from userspace, without validating it before using it to allocate memory with kmalloc().

If a user supplies a very small wqe_size (for example, 1), kmalloc() will allocate a small buffer successfully, but subsequent code will read beyond this allocated buffer when accessing fields like opcode and num_sge. This causes an out-of-bounds read from kernel heap memory, which could leak sensitive kernel information to userspace.

Conversely, if an excessively large wqe_size is provided, it can trigger warnings in the memory allocation path.

The vulnerability arises because ib_uverbs_post_send() does not validate that wqe_size is at least the size of the expected structure (struct ib_uverbs_send_wr), unlike a similar function ib_uverbs_unmarshall_recv() which performs this validation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to an out-of-bounds read from kernel heap memory, which means that sensitive kernel information could be leaked to userspace. Such information leakage can potentially be exploited by attackers to gain insights into kernel memory layout or other sensitive data.

Additionally, providing an excessively large wqe_size can cause warnings in the kernel's memory allocation path, which might affect system stability or reliability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper validation of the wqe_size parameter in the ib_uverbs_post_send() function of the Linux kernel RDMA subsystem. Detection would involve monitoring for abnormal or suspicious usage of RDMA user verbs, especially calls to ib_uverbs_post_send() with unusually small or large wqe_size values.

However, no specific detection commands or tools are provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by adding validation to ensure that wqe_size is at least the size of struct ib_uverbs_send_wr before it is used. Therefore, the immediate mitigation step is to update the Linux kernel to a version that includes this fix.

Until the kernel is updated, avoid running untrusted userspace code that can invoke ib_uverbs_post_send() with arbitrary wqe_size values, as this could lead to out-of-bounds reads and potential information leaks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially lead to the leakage of sensitive kernel information to userspace due to an out-of-bounds read from kernel heap memory.

Such leakage of sensitive information may impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive data and preventing unauthorized disclosure.

However, the provided information does not explicitly describe the direct impact on compliance with these standards.

Useful 0 Not Useful 0