Linux kernel RDS RDMA path net/rds/rdma.c - rds_rdma_pages: The page-count arithmetic for an RDS RDMA scatter-gather

Impact

The page-count arithmetic for an RDS RDMA scatter-gather request overflows on a crafted iovec, so the kernel allocates a short buffer and then fills it as if it were large - a heap overflow reachable by an unprivileged local user, with code execution not excluded. This is the RDMA-specific sibling of the RDS root bug above and lives in exactly the code path an operator would be exercising if they did adopt RDS over InfiniBand for a low-latency service.

Who can reach it

Local, unprivileged - an RDS socket plus a crafted iovec. Same autoload consideration as CVE-2010-3904.

What to do

Kernel upgrade or vendor backport; rolling reboot across the fleet. As with CVE-2010-3904, blacklisting the rds module is the immediate, no-downtime control and is the right default on any node that does not deliberately run RDS - which is nearly all of them.

References