Linux kernel RDS connection info (uninitialised per-item buffer copied to userspace): The connection-info walkers hand

Impact

The connection-info walkers hand a per-item stack buffer to a visitor and then copy the full declared item length back to userspace regardless of how much the visitor filled in. When a connection is not in the UP state the IB visitors write only a subset - several u32 fields and an alignment hole are left holding whatever was on the kernel stack - and all of it is copied out. Any unprivileged process that can query RDS info harvests kernel stack bytes, which is the standard first step for defeating KASLR before using a corruption bug.

Who can reach it

Local, unprivileged. Query RDS connection info while at least one connection is not in the UP state - trivially arranged by the querying tenant.

What to do

Kernel update zeroing the item buffer before each visitor call. Blacklisting rds removes the surface immediately.

References