NULL dereference in Linux kernel RDS/IB atomic operation handling

Executive Summary

This vulnerability exists in the Linux kernel's RDS (Reliable Datagram Sockets) over InfiniBand (IB) implementation. Specifically, it involves a NULL pointer dereference in the function rds_ib_send_cqe_handler() when handling masked atomic completions.

The issue arises because rds_ib_xmit_atomic() always programs a masked atomic opcode for every RDS atomic cmsg, but the completion-side function rds_ib_send_unmap_op() only handles non-masked opcodes. As a result, when a masked atomic completion occurs, it falls through to a default case returning a NULL pointer, which is then dereferenced in rds_ib_send_cqe_handler(), causing a kernel oops (crash) in softirq context.

An unprivileged user can trigger this by sending an atomic cmsg over an active RDS/IB connection, especially on hardware that supports masked atomics natively (such as mlx4 or mlx5), without needing extra setup.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability causes a NULL pointer dereference in the Linux kernel's RDS/IB subsystem, which can lead to a kernel oops or panic when an unprivileged AF_RDS sendmsg() of an atomic cmsg is performed over an active RDS/IB connection.

Detection can be done by monitoring kernel logs for specific error messages such as:

• "RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR!"
• "Oops: general protection fault [#1] SMP KASAN"
• "KASAN: null-ptr-deref in range"
• "Kernel panic - not syncing: Fatal exception in interrupt"

You can check kernel logs using commands like:

• dmesg | grep -i 'rds_ib_send_unmap_op'
• journalctl -k | grep -i 'rds_ib_send_unmap_op'
• dmesg | grep -i 'null-ptr-deref'
• journalctl -k | grep -i 'null-ptr-deref'

Additionally, monitoring for kernel oops or panic events related to RDS/IB can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, the immediate step is to update the Linux kernel to a version where this issue is fixed.

The fix involves handling masked atomic opcodes correctly in the rds_ib_send_unmap_op() function to prevent NULL pointer dereference and kernel panic.

If updating the kernel is not immediately possible, consider disabling or restricting the use of RDS over InfiniBand (RDS/IB) connections, especially blocking unprivileged users from sending atomic cmsgs over active RDS/IB connections.

Monitoring and restricting access to AF_RDS sockets and controlling which users can send messages over RDS/IB may reduce the risk of triggering this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a kernel crash (kernel oops) due to a NULL pointer dereference in the Linux kernel's networking stack when handling certain RDS atomic messages over InfiniBand.

The impact includes potential denial of service (DoS) on affected systems, as the kernel panic or oops can disrupt normal operations and require a reboot or recovery.

Since the vulnerability can be triggered by an unprivileged user sending a specially crafted message, it could be exploited to disrupt services or affect system stability on systems using RDS over InfiniBand.

Useful 0 Not Useful 0