Linux kernel RDS RDMA path net/rds/rdma.c - rds_rdma_pages: The page-count arithmetic for an RDS RDMA scatter-gather

CVSS 7.8CVE-2010-3865Firmware, BMC & network fabriccurated

Impact

The page-count arithmetic for an RDS RDMA scatter-gather request overflows on a crafted iovec, so the kernel allocates a short buffer and then fills it as if it were large - a heap overflow reachable by an unprivileged local user, with code execution not excluded. This is the RDMA-specific sibling of the RDS root bug above and lives in exactly the code path an operator would be exercising if they did adopt RDS over InfiniBand for a low-latency service.

Who can reach it

Local, unprivileged - an RDS socket plus a crafted iovec. Same autoload consideration as CVE-2010-3904.

What to do

Kernel upgrade or vendor backport; rolling reboot across the fleet. As with CVE-2010-3904, blacklisting the rds module is the immediate, no-downtime control and is the right default on any node that does not deliberately run RDS - which is nearly all of them.

References

https://access.redhat.com/security/cve/CVE-2010-3865 https://www.openwall.com/lists/oss-security/2010/11/19/4 https://nvd.nist.gov/vuln/detail/CVE-2010-3865

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.