ibacm 1.0.7 (InfiniBand Communication Manager Assistant daemon) - world-writable log and ibacm.port files: The RDMA

Impact

The RDMA fabric-assistance daemon creates its files world-writable, so any local user rewrites the ibacm.port file - which is precisely the input librdmacm consults to decide which ib_acm service to trust for address resolution. On its own it is a permissions bug; chained with CVE-2012-4516 it lets an unprivileged tenant on a shared node redirect every other process's RDMA address resolution to a service the tenant controls. Also lets a tenant tamper with the daemon's log, which removes the record of them having done it.

Who can reach it

Local, unprivileged - any user on a node running ibacm. On a shared or multi-tenant management/compute node this is any tenant process.

What to do

Update ibacm past 1.0.7 (upstream commit d204fca2b6298d7799e918141ea8e11e7ad43cec; Red Hat shipped it in RHSA-2013-0509) and restart the daemon. No reboot needed. Independently verifiable and worth checking right now regardless of package version: stat the ibacm files on a live node and confirm they are not group- or world-writable, since a permissions defect can be reintroduced by packaging, by a container image, or by an operator's own configuration-management run long after the upstream fix.

References