oss-sec mailing list archives
Re: CVE Request: Linux: IB/security: Restrict use of the write() interface'
From: Yann Droneaud <ydroneaud () opteya com>
Date: Mon, 09 May 2016 21:48:59 +0200
Hi, Le samedi 07 mai 2016 à 06:22 +0200, Salvatore Bonaccorso a écrit :
Jann Horn reported an issue in the infiniband stack. It has been fixed in v4.6-rc6 with commit e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3: https://git.kernel.org/linus/e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3IB/security: Restrict use of the write() interface The drivers/infiniband stack uses write() as a replacement for bi-directional ioctl(). This is not safe. There are ways to trigger write calls that result in the return structure that is normally written to user space being shunted off to user specified kernel memory instead. For the immediate repair, detect and deny suspicious accesses to the write API. For long term, update the user space libraries and the kernel API to something that doesn't present the same security vulnerabilities (likely a structured ioctl() interface). The impacted uAPI interfaces are generally only available if hardware from drivers/infiniband is installed in the system.
As a workaround, I would suggest that systems which do not require (userspace) RDMA/Infiniband to blacklist/remove the following modules: rdma_ucm ib_uverbs ib_ucm ib_umad For example, adds the following in /etc/modprobe.d/blacklist.conf blacklist rdma_ucm blacklist ib_uverbs blacklist ib_ucm blacklist ib_umad Those building their own kernel might want to disable, if not already, CONFIG_INFINIBAND_USER_ACCESS, CONFIG_INFINIBAND_USER_MAD, CONFIG_INFINIBAND_ADDR_TRANS (Unfortunately the last one will also disable those features: iSCSI Extensions for RDMA (iSER) iSCSI Extensions for RDMA (iSER) target support RDS over Infiniband and iWARP 9P RDMA Transport (Experimental) RPC-over-RDMA transport (which actually disable NFSoRDMA)) Regards. -- Yann Droneaud OPTEYA
Current thread:
- CVE Request: Linux: IB/security: Restrict use of the write() interface' Salvatore Bonaccorso (May 06)
- Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' cve-assign (May 07)
- Message not available
- Message not available
- Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' Yann Droneaud (May 09)
- Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' Jann Horn (May 09)
- Message not available
- Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' Yann Droneaud (May 09)
- Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' ira.weiny (May 12)