CVE-2012-4516: Medium severity OpenFabrics librdmacm vulnerability
A security flaw was found in the way librdmacm, a userspace RDMA Communication Managment API allowing to specify connections using TCP/IP addresses even though it opens RDMA specific connections, performed binding to the underlying ibacm service (librdmacm used default port value of 6125 to bind to ibacm service). An attacker able to run a rogue ibacm service could use this flaw to make librdmacm applications to use potentially bogus address resolution information.
Upstream patch: [1] http://git.openfabrics.org/git?p=~shefty/librdmacm.git;a=commitdiff;h=4b5c1aa734e0e734fc2ba3cd41d0ddf02170af6d
Acknowledgements:
This issue was discovered by Florian Weimer of Red Hat Product Security Team.
Other sources
librdmacm 1.0.16, when ibacm.port is not specified, connects to port 6125, which allows remote attackers to specify the address resolution information for the application via a malicious ibacm service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4516?
CVE-2012-4516 has a medium severity risk due to improper binding in the librdmacm library.
How do I fix CVE-2012-4516?
To fix CVE-2012-4516, update librdmacm to version 1.0.17 or later where the vulnerability is addressed.
What software is affected by CVE-2012-4516?
CVE-2012-4516 affects librdmacm version 1.0.16.
What is librdmacm in relation to CVE-2012-4516?
Librdmacm is a userspace RDMA Communication Management API that was found to have a security flaw in CVE-2012-4516.
What are the potential impacts of CVE-2012-4516?
The potential impacts of CVE-2012-4516 include unauthorized access to RDMA connections due to improper service binding.