Linux Kernel RDMA Component Netlink Attribute Vulnerability

A vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) component has been addressed. The issue arose because certain netlink attributes were treated as C-strings for comparison purposes, but the attribute type 'NLA_STRING' did not ensure the presence of a null terminator. This could lead to improper string handling and potential vulnerabilities. The solution was to change the attribute type to 'NLA_NUL_STRING', which correctly accounts for the null terminator. This change was necessary to prevent any ambiguity in string termination, ensuring that user space applications can reliably interpret the strings being passed.

Impact

The vulnerability could have led to incorrect string handling in user space applications, potentially causing errors or unexpected behavior when processing RDMA-related netlink messages.

Reproduction

The vulnerability could be reproduced by sending netlink messages to the kernel's RDMA subsystem that include attributes of type 'NLA_STRING'. These attributes would be evaluated as C-strings, but without the necessary null terminator, leading to improper string handling. This issue could be observed in the context of the iWARP Port Mapper user space service, which relies on these netlink attributes to function correctly.

Remediation

Users can update to the latest version of the Linux kernel, where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.