Linux NFS-over-RDMA server (svcrdma, xdr_check_write_chunk): An untrusted segcount from the client is multiplied

Impact

An untrusted segcount from the client is multiplied without overflow checking when validating an RDMA Write chunk, so the buffer-overflow check itself is defeated and the server reads past the receive buffer. On an RDMA-attached storage server this is reachable directly from a tenant's HCA.

Who can reach it

Any NFS/RDMA client on the fabric - a tenant compute node with an RDMA NIC and the export mounted over rdma.

What to do

Update the storage server kernel to one with the svcrdma overflow fix and reboot. If you cannot patch quickly, fall back to NFS over TCP (proto=tcp) on the affected exports, accepting the throughput loss.

References