Junglewise Threat Intelligence

CVE-2024-35902: Linux Kernel NULL pointer dereference in net/rds

CVE-2024-35902 · Severity: medium · CVSS 5.5 · Published 2024-05-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. RDS is a high-performance networking protocol used primarily in data centers and high-performance computing environments. An exploit could allow a local user to crash the system, leading to a denial-of-service condition that impacts operational availability.

Technical details

A NULL pointer dereference vulnerability exists in the net/rds component of the Linux kernel, specifically within the __rds_rdma_map function. The vulnerability occurs because the code fails to verify if the 'cp' (connection path) pointer is NULL before attempting to access its 'cp_conn' member during error handling for -ENODEV returns. Certain call sites, such as rds_get_mr() and rds_get_mr_for_dest(), are known to pass a NULL 'cp' argument. A local attacker can trigger this condition to cause a kernel panic (Denial of Service). The issue has been resolved by adding a conditional check to ensure 'cp' is valid before dereferencing it.

Affected products

  • Linux Linux Kernel 4.19.310 to 4.19.312, 5.4.272 to 5.7.274, 5.10.213 to 5.10.215, 5.15.152 to 5.15.154, 6.1.82 to 6.1.85, 6.6.22 to 6.6.26, 6.7.10 to 6.8.5, 6.9-rc1, 6.9-rc2

Timeline

  • 2024-03-26: patched: Initial patch submitted by Mahmoud Adam
  • 2024-05-19: disclosed: CVE-2024-35902 published

References

Related threats