REDHAT-BUG-865483: Low severity OpenFabrics librdmacm vulnerability
A security flaw was found in the way librdmacm, a userspace RDMA Communication Managment API allowing to specify connections using TCP/IP addresses even though it opens RDMA specific connections, performed binding to the underlying ibacm service (librdmacm used default port value of 6125 to bind to ibacm service). An attacker able to run a rogue ibacm service could use this flaw to make librdmacm applications to use potentially bogus address resolution information.
Upstream patch: [1] http://git.openfabrics.org/git?p=~shefty/librdmacm.git;a=commitdiff;h=4b5c1aa734e0e734fc2ba3cd41d0ddf02170af6d
Acknowledgements:
This issue was discovered by Florian Weimer of Red Hat Product Security Team.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-865483?
The severity of REDHAT-BUG-865483 is categorized as medium due to its potential impact on security when using the librdmacm API.
How do I fix REDHAT-BUG-865483?
To fix REDHAT-BUG-865483, upgrade to the latest version of librdmacm where the vulnerability has been addressed.
What type of software is affected by REDHAT-BUG-865483?
REDHAT-BUG-865483 affects the OpenFabrics librdmacm, a userspace RDMA Communication Management API.
How does REDHAT-BUG-865483 impact system security?
REDHAT-BUG-865483 can potentially lead to unauthorized access to RDMA resources by misbinding to TCP/IP addresses.
Is there a known exploit for REDHAT-BUG-865483?
As of now, there is no publicly known exploit specifically targeting REDHAT-BUG-865483.