In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Reject Read lists that exceed the page budget
Individual Read segment lengths are validated at decode time, but
nothing prevents a requester from sending multiple segments whose
cumulative length exceeds the rq_pages array budget. When one
segment fills the page array exactly, the runtime guard in
svc_rdma_build_read_segment() is bypassed because len reaches zero. A subsequent segment then accesses the NULL sentinel slot at
rq_pages[rq_maxpages], resulting in a NULL pointer dereference during
DMA mapping.
Accumulate pages across all Read segments and reject the message at decode time when the total would overflow the page budget.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 3
https://git.kernel.org/stable/c/0ca487abb3bdf581851664b5db21f364caf57682
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/1a3af2262cb384112ef38632de4690682be528b4
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/465f511f59a0fa7a80d5d1073c4b24f28ea38f58
416baaa9-dc9f-4396-8d5f-8c081fb06d67