EGI CSIRT:Alerts/rds-rdma-2010-11-02

========== DRAFT ===========

** WHITE information - Unlimited distribution allowed                         **
** see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions **
 
EGI CSIRT ADVISORY [EGI-ADV-20101102]
 
Title:       HIGH Vulnerability CVE-2010-3865 kernel: iovec integer overflow in net/rds/rdma.c  [EGI-ADV-20101102]
Date:        November 01, 2010
Last update: November 01, 2010
URL:         https://wiki.egi.eu/w/index.php?title=EGI_CSIRT:Alerts/rds-rdma-2010-11-02&action=edit
https://wiki.egi.eu/wiki/EGI_CSIRT:Alerts/liblinker-2010-10-23

Introduction
============
Another problem in the RDS-Module is detected:
https://bugzilla.redhat.com/show_bug.cgi?id=647416
it looks like they think it might even be possible to remotely exploit
this over an Infiniband network ("Access Vector: Adjacent"). But,
presumably, for this to be exploitable *over the network*, the victim
host would have to listen on an RDS socket, which should be very rare.
But locally it's probably exploitable on any machine.

Note that the kernel update fixing CVE-2010-3904 does *not* fix CVE-2010-3865.

The EGI CSIRT considers this to be a IMPORTANT vulnerability.

Details
=======


Mitigation
==========
Most systems do not utilize RDS and can simply block the vulnerability
by blacklisting the RDS module (after unloading it if it is present),
for instance by running this script:

------------------

#!/bin/sh

# Unload the module

if lsmod | grep -q '^rds '; then
  echo "RDS was loaded"
fi
rmmod rds 2>/dev/null
if lsmod | grep -q '^rds '; then
  echo "FAILED to unload RDS"
fi

# Blacklist the module
echo "install rds /bin/true" > /etc/modprobe.d/disable-rds 

echo "alias net-pf-28 off" > /etc/modprobe.d/disable-rds"

------------------

This will take effect immediately and does not require a reboot. The
blacklisting will stay persistent across reboots.

Please note that some clusters with Infiniband may actually use RDS.
In these cases, the only solution is to deploy a patched kernel.


Recommendations
===============

Immediately apply the mitigation described above to all
user-accessible systems.

Apply vendor kernel updates when they become available.

Since the rds module seems to have more problems it would be safer to keep
this module blacklisted if not needed at your site.


References
==========
https://bugzilla.redhat.com/show_bug.cgi?id=647416
https://www.redhat.com/security/data/cve/CVE-2010-3865.html