oss-security - CVE Request -- librdmacm (one issue) / ibacm (two issues)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <295875159.13372001.1349970479301.JavaMail.root@redhat.com>
Date: Thu, 11 Oct 2012 11:47:59 -0400 (EDT)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
Cc: oss-security@...ts.openwall.com, Florian Weimer <fweimer@...hat.com>,
        Doug Ledford <dledford@...hat.com>, Sean Hefty <sean.hefty@...el.com>
Subject: CVE Request -- librdmacm (one issue) / ibacm (two issues)

Hello Kurt, Steve, vendors,

  multiple issues has been found in tools enabling InfiniBand functionality:

Issue #1 librdmacm - Tried to connect to port 6125 if ibacm.port was not found:
===============================================================================
  A security flaw was found in the way librdmacm, a userspace RDMA Communication
Managment API allowing to specify connections using TCP/IP addresses even though
it opens RDMA specific connections, performed binding to the underlying ib_acm
service (librdmacm used default port value of 6125 to bind to ib_acm service).
An attacker able to run a rogue ib_acm service could use this flaw to make
librdmacm applications to use potentially bogus address resolution information.

References: https://bugzilla.redhat.com/show_bug.cgi?id=865483
Upstream patch: http://git.openfabrics.org/git?p=~shefty/librdmacm.git;a=commitdiff;h=4b5c1aa734e0e734fc2ba3cd41d0ddf02170af6d

Credit: This issue was discovered by Florian Weimer of Red Hat Product Security Team.

Issue #2 ibacm - DoS (ib_acm deamon crash) by joining responses for multicast destinations:
===========================================================================================
  A denial of service flaw was found in the way ibacm, an InfiniBand communication manager
assistant, performed management of reference counts for multicast connections. The default
reference count value for multicast connection is set to zero and when the multicast connection
got released, an attempt was made to free it, possibly resulting in ib_acm service / daemon
crash.

References: https://bugzilla.redhat.com/show_bug.cgi?id=865492
Relevant upstream patch: http://git.openfabrics.org/git?p=~shefty/ibacm.git;a=commit;h=c7d28b35d64333c262de3ec972c426423dadccf9

Issue previously corrected by upstream and its security implications pointed out later
by Florian Weimer of Red Hat Product Security Team.

Issue #3 ibacm - ib_acm service files created with world writable permissions (DoS):
====================================================================================
  A security flaw was found in the way ibacm, an InfiniBand communication manager
assistant, created files used by ib_acm service - they were created with world
writable permissions. A local attacker could use this flaw to 1) overwrite content
of ib_acm daemon log file or 2) overwrite content of ib_acm daemon ibacm.port file
(ability to mask certain actions or cause ib_acm to run on non-default port).

References: https://bugzilla.redhat.com/show_bug.cgi?id=865499
Relevant upstream patch: http://git.openfabrics.org/git?p=~shefty/ibacm.git;a=commit;h=d204fca2b6298d7799e918141ea8e11e7ad43cec

Credit: This issue was discovered by Florian Weimer of Red Hat Product Security Team.

--

Could you allocate CVE identifiers for these?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.