REDHAT-BUG-865483
First published: Thu Oct 11 2012(Updated: )
A security flaw was found in the way librdmacm, a userspace RDMA Communication Managment API allowing to specify connections using TCP/IP addresses even though it opens RDMA specific connections, performed binding to the underlying ib_acm service (librdmacm used default port value of 6125 to bind to ib_acm service). An attacker able to run a rogue ib_acm service could use this flaw to make librdmacm applications to use potentially bogus address resolution information. Upstream patch: [1] <a href="http://git.openfabrics.org/git?p=~shefty/librdmacm.git;a=commitdiff;h=4b5c1aa734e0e734fc2ba3cd41d0ddf02170af6d">http://git.openfabrics.org/git?p=~shefty/librdmacm.git;a=commitdiff;h=4b5c1aa734e0e734fc2ba3cd41d0ddf02170af6d</a> Acknowledgements: This issue was discovered by Florian Weimer of Red Hat Product Security Team.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| librdmacm |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.openfabrics.org/git?p=~shefty/librdmacm.git;a=commitdiff;h=4b5c1aa734e0e734fc2ba3cd41d0ddf02170af6d
- http://www.openwall.com/lists/oss-security/2012/10/11/6
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=865510
- https://access.redhat.com/security/cve/CVE-2012-4516
- https://rhn.redhat.com/errata/RHSA-2013-1661.html
- https://bugzilla.redhat.com/show_bug.cgi?id=865483
Frequently Asked Questions
What is the severity of REDHAT-BUG-865483?
The severity of REDHAT-BUG-865483 is categorized as medium due to its potential impact on security when using the librdmacm API.
How do I fix REDHAT-BUG-865483?
To fix REDHAT-BUG-865483, upgrade to the latest version of librdmacm where the vulnerability has been addressed.
What type of software is affected by REDHAT-BUG-865483?
REDHAT-BUG-865483 affects the OpenFabrics librdmacm, a userspace RDMA Communication Management API.
How does REDHAT-BUG-865483 impact system security?
REDHAT-BUG-865483 can potentially lead to unauthorized access to RDMA resources by misbinding to TCP/IP addresses.
Is there a known exploit for REDHAT-BUG-865483?
As of now, there is no publicly known exploit specifically targeting REDHAT-BUG-865483.
- collector/redhat-bugzilla
- alias/CVE-2012-4516
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/description
- agent/softwarecombine
- agent/tags
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/openfabrics
- canonical/librdmacm