Linux Kernel RDMA/Ionic Unbounded Sysfs Read Vulnerability

A vulnerability in the Linux kernel's RDMA/Ionic component allows for an unbounded read from the sysfs node description. The issue arises because the node description in the 'ib_device' structure is not guaranteed to be null-terminated. The core InfiniBand sysfs handler uses a format specifier that expects a null-terminated string, but the 'node_desc_store' function can write up to the maximum node description length without adding a null terminator. This flaw can be exploited by user space applications, as the Ionic hardware component supports modifying the node description.

Impact

Exploitation of this vulnerability could lead to reading past the intended buffer into adjacent fields of the 'ib_device' structure, potentially causing memory corruption or disclosure of sensitive information.

Reproduction

To reproduce this vulnerability, write exactly 64 bytes to the 'node_desc' sysfs file of an RDMA/Ionic device. This will result in the 'node_desc' array not being null-terminated. Then, read the 'hca_type' attribute, which will use an unbounded format specifier to access the 'node_desc' data. The read operation will continue past the end of the node description into neighboring fields of the 'ib_device' structure until a null byte is encountered.

Remediation

The vulnerability has been addressed by modifying the Ionic sysfs handler to use a bounded format specifier that matches the core InfiniBand sysfs handler. Users should update to the latest version of the Linux kernel where this fix has been applied.