Описание
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: fix integer overflow in immediate data length check
imm_buf->len is a user-controlled uint32_t received from the network.
Adding it to imm_data_offset without overflow checking allows a
malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap
around to a small value, bypassing the bounds check, and subsequently
passing a ~4GB length to sg_init_one().
Use check_add_overflow() to detect wrapping before the comparison.
A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) SCSI RDMA Protocol (SRP) Target (srpt) component. A remote attacker could exploit an integer overflow vulnerability in the immediate data length check. By sending a specially crafted network packet, a malicious initiator can cause the length calculation to wrap around, bypassing security checks and potentially leading to memory corruption or a denial of service.
Меры по смягчению последствий
Prevent the ib_srpt kernel module from being loaded by blacklisting it in the modprobe configuration.
- Add the module to a configuration file under /etc/modprobe.d/:
echo 'install ib_srpt /bin/true' > /etc/modprobe.d/disable-ib_srpt.conf
echo 'blacklist ib_srpt' >> /etc/modprobe.d/disable-ib_srpt.conf
- If the module is currently loaded in memory, unload it:
modprobe -r ib_srpt
Caveats: This workaround disables all SCSI RDMA Protocol (SRP) target functionality on the host. Systems actively configured to provide storage targets over InfiniBand or RoCE cannot apply this mitigation without stopping SRP services. Warning: Unloading the kernel module or rebooting the host will terminate active SRP sessions and can disrupt attached storage clients.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 9 | kernel | Affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one(). Use check_add_overflow() to detect wrapping before the comparison.
In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one(). Use check_add_overflow() to detect wrapping before the comparison.
In the Linux kernel, the following vulnerability has been resolved: R ...
EPSS
7.5 High
CVSS3