Linux kernel RDS net/rds/recv.c - rds_inc_info_copy: A structure member is left uninitialised before the RDS message

Impact

A structure member is left uninitialised before the RDS message info block is copied out, so reading an RDS message returns kernel stack bytes to the reader. MITRE scopes this to remote attackers, which on an RDS-over-InfiniBand fabric means a peer node - another tenant's machine - harvesting the target's kernel stack over the wire. It is small per message and unlimited in repetition, so an attacker collects continuously until they have the pointers they need. In practice this is the reconnaissance half of a chain: leak enough kernel addresses to defeat KASLR, then fire one of the RDS or uverbs corruption bugs with a known target layout.

Who can reach it

Network / adjacent fabric, pre-auth from the perspective of the leaking host - the attacker reads RDS messages it is entitled to receive and gets kernel memory as a side effect.

What to do

Kernel upgrade including commit 4116def2337991b39919f3b448326e21c40e0dbb (rds: fix an infoleak in rds_inc_info_copy); rolling reboot. As with the other RDS entries here, the zero-cost control most operators should apply first is to blacklist the rds module on every node that does not deliberately use it, which removes this and the RDS memory-corruption bugs at once and needs no reboot.

References