Executive Summary

This vulnerability exists in the Linux kernel's RDS (Reliable Datagram Sockets) subsystem, specifically in how certain functions handle a buffer before passing it to user space. The functions rds_for_each_conn_info() and rds_walk_conn_path_info() provide a caller-allocated on-stack buffer to a visitor function and then copy the entire buffer back to user space without ensuring all parts of the buffer are properly initialized.

When the RDS connection is not fully established (not in state RDS_CONN_UP), some fields in the buffer remain uninitialized and contain leftover stack data, including potentially sensitive kernel memory pointers and other garbage data. This happens because the output structures have alignment holes and only partially write their data, leaving some parts of the buffer with stale stack contents.

A local unprivileged user can trigger this by opening an AF_RDS socket, setting it to use RDMA transport, binding to a local address, sending data to a peer, and then calling a getsockopt() to retrieve connection info. The returned data can leak kernel stack contents, including kernel pointers.

The fix was to zero out the entire per-item buffer before passing it to the visitor functions, ensuring no uninitialized stack data is leaked to user space.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to information disclosure where a local unprivileged user can obtain sensitive kernel memory contents, including kernel pointers and other stack data that should not be exposed.

Leaking kernel pointers can aid attackers in bypassing kernel address space layout randomization (KASLR) protections, potentially facilitating further attacks such as privilege escalation or arbitrary code execution.

Although the vulnerability requires local access and specific conditions (using AF_RDS sockets with RDMA transport), it still poses a risk of exposing sensitive kernel information to unauthorized users.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of uninitialized stack data being leaked through the RDS (Reliable Datagram Sockets) interface when querying RDMA connection information.

A local unprivileged user can reproduce the issue by opening an AF_RDS socket, setting SO_RDS_TRANSPORT to IB (InfiniBand), binding to a local RDMA-capable network device, sending data to a peer on the same subnet, and then calling getsockopt() with SOL_RDS and RDS_INFO_IB_CONNECTIONS to retrieve connection info that may contain stack garbage.

Commands to detect this behavior might include:

• Open an RDS socket: `socket(AF_RDS, SOCK_SEQPACKET, 0)`
• Set the transport to InfiniBand: `setsockopt(sock, SOL_RDS, SO_RDS_TRANSPORT, &RDMA_TRANSPORT_IB, sizeof(int))`
• Bind to a local RDMA-capable address.
• Send data to a peer on the same subnet using `sendto()`.
• Retrieve connection info with: `getsockopt(sock, SOL_RDS, RDS_INFO_IB_CONNECTIONS, &buffer, &buffer_len)` and inspect the returned data for uninitialized stack contents or kernel pointers.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation is to update the Linux kernel to a version where this vulnerability has been fixed.

The fix involves zeroing the per-item info buffer before it is handed to visitors in the RDS code, preventing uninitialized stack data from being leaked.

Until the kernel is updated, restrict unprivileged users from opening AF_RDS sockets or limit access to RDMA-capable network devices to trusted users only.

Useful 0 Not Useful 0