CVE-2015-7990: Race Condition
A NULL pointer dereference in the RDS connection code when sending a message to an apparently unbound socket in net/rds/connection.c was found. The problem is caused by the code checking if the socket is bound in rdssendmsg(), which checks the rsboundaddr field without taking a lock on the socket. This opens a race where rsboundaddr is temporarily set but where the transport is not in rdsbind(), leading to a NULL pointer dereference when trying to dereference 'trans' in rdsconncreate().
Note that this is a complete fix of CVE-2015-6937 issue.
Patch can be found here:
https://lkml.org/lkml/2015/10/16/530
CVE assignment:
http://seclists.org/oss-sec/2015/q4/179
Workaround:
The Linux kernel will attempt to automatically load the RDS module when the RDS protocol is used from userspace. The module can be prevented being loaded with the commands:
echo "install rds /bin/true" > /etc/modprobe.d/disable-rds echo "alias net-pf-28 off" >> /etc/modprobe.d/disable-rds
Earlier versions of Red Hat Enterprise Linux can be disabled with instructions from here: https://access.redhat.com/solutions/41278
If the module is already loaded prior to this, it must be removed or the system must be rebooted to preven it loading in the future.
Other sources
Race condition in the rdssendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2015-7990.
What is the severity of CVE-2015-7990?
The severity of CVE-2015-7990 is medium.
What is the description of CVE-2015-7990?
CVE-2015-7990 is a race condition vulnerability in the rds_sendmsg function in the Linux kernel before version 4.3.3, which allows local users to cause a denial of service or have other unspecified impact.
How can I fix CVE-2015-7990?
To fix CVE-2015-7990, you should update your Linux kernel to version 4.3.3 or later.
Where can I find more information about CVE-2015-7990?
You can find more information about CVE-2015-7990 at the following references: [Reference 1](https://lkml.org/lkml/2015/10/16/530), [Reference 2](http://www.openwall.com/lists/oss-security/2015/10/27/5), [Reference 3](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8c7188b23474cca017b3ef354c4a58456f68303a).