It was reported [1] that ibutils 1.5.7 suffered from a flaw due to improper handling of files in the /tmp directory. This makes ibutils vulnerable to symlink attacks, which could be used to overwrite arbitrary files on the system.

[1] http://seclists.org/fulldisclosure/2013/Mar/87

ibacm 1.0.7 creates files with world-writable permissions, which allows local users to overwrite the ibacm daemon log or ibacm.port file.

A denial of service flaw was found in the way ibacm, an InfiniBand communication manager assistant, performed management of reference counts for multicast connections. The default reference count value for multicast connection is set to zero and when the multicast connection got released, an attempt was made to free it, possibly resulting in ibacm service / daemon crash.

Upstream patch: [1] http://git.openfabrics.org/git?p=~shefty/ibacm.git;a=commit;h=c7d28b35d64333c262de3ec972c426423dadccf9

A denial of service flaw was found in the way ibacm, an InfiniBand communication manager assistant, performed management of reference counts for multicast connections. The default reference count value for multicast connection is set to zero and when the multicast connection got released, an attempt was made to free it, possibly resulting in ibacm service / daemon crash.

Upstream patch: [1] http://git.openfabrics.org/git?p=~shefty/ibacm.git;a=commit;h=c7d28b35d64333c262de3ec972c426423dadccf9

A security flaw was found in the way librdmacm, a userspace RDMA Communication Managment API allowing to specify connections using TCP/IP addresses even though it opens RDMA specific connections, performed binding to the underlying ibacm service (librdmacm used default port value of 6125 to bind to ibacm service). An attacker able to run a rogue ibacm service could use this flaw to make librdmacm applications to use potentially bogus address resolution information.

Upstream patch: [1] http://git.openfabrics.org/git?p=~shefty/librdmacm.git;a=commitdiff;h=4b5c1aa734e0e734fc2ba3cd41d0ddf02170af6d

Acknowledgements:

This issue was discovered by Florian Weimer of Red Hat Product Security Team.

A security flaw was found in the way librdmacm, a userspace RDMA Communication Managment API allowing to specify connections using TCP/IP addresses even though it opens RDMA specific connections, performed binding to the underlying ibacm service (librdmacm used default port value of 6125 to bind to ibacm service). An attacker able to run a rogue ibacm service could use this flaw to make librdmacm applications to use potentially bogus address resolution information.

Upstream patch: [1] http://git.openfabrics.org/git?p=~shefty/librdmacm.git;a=commitdiff;h=4b5c1aa734e0e734fc2ba3cd41d0ddf02170af6d

Acknowledgements:

This issue was discovered by Florian Weimer of Red Hat Product Security Team.

ulp/sdp/sdpproc.c in the ibsdp module (aka ibsdp.ko) in the ofakernel package in the InfiniBand driver implementation in OpenFabrics Enterprise Distribution (OFED) before 1.5.3 does not properly handle certain non-array variables, which allows local users to cause a denial of service (stack memory corruption and system crash) by reading the /proc/net/sdpstats file.

Leif Nixon reported that libsdp is vulnerable to insecure log file handling.

libsdp is a library that is supposed to be LDPRELOAD'd to enable an application to communicate over the Infiniband SDP protocol instead of ordinary TCP. When libsdp is dlopened, by default it will fopen a log file with a predictable name: /var/log/libsdp for root processes, and /tmp/libsdp.log.$UID for non-root processes. The root process log file is suitably protected, however the non-root processes are not.

The vulnerable code is in src/log.c, which does first check that the destination is not a symlink, in which case it will refuse to open it. However, this is still vulnerable to a hardlink attack, and a race condition where a symlink can be created between the lstat() call and the fopen() call:

192 / double check the file is not a link / 193 status = lstat(tfilename, &lstatres); 194 if ( (status == 0) && SISLNK(lstatres.stmode) ) { 195 sdplog( 9, "Cowardly refusing to log into:'%s'. " 196 "It is a link - thus is a security issue.\n", tfilename ); 197 return 0; 198 } 199 200 f = fopen( tfilename, "a" );

This vulnerability is fixed in the latest version of libsdp (libsdp-1.1.105-0.4.g1b9b996.tar.gz) available at: http://www.openfabrics.org/downloads/libsdp/

Acknowledgements:

Red Hat would like to thank Leif Nixon for reporting this issue.

openibd in OpenFabrics Enterprise Distribution (OFED) 1.5.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/ibsetnodedesc.sh temporary file.

ibutils packages as shipped in Red Hat Enterprise Linux 4 and 5 are built to use insecure RPATH set in the ELF header of the ibmssh command.

This issue can possibly be exploited by a local attacker to run arbitrary code as some other user if victim user can be convinced to run ibmssh command in an attacker controlled directory with specially crafted content.

Affected binary: /usr/bin/ibmssh RPATH: refix/lib