Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : https://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can generate a memory corruption in InfiniBand of the
Linux kernel, in order to trigger a denial of service, and
possibly to run code.

Impacted products: Debian, Linux, openSUSE Leap, RHEL, SUSE Linux
Enterprise Desktop, SLES, Ubuntu.

Severity: 2/4.

Creation date: 09/05/2016.

DESCRIPTION OF THE VULNERABILITY

The InfiniBand technology is used to transmit data efficiently.

However, several functions directly call write() without checking
if the memory address is located in user space.

An attacker can therefore generate a memory corruption in
InfiniBand of the Linux kernel, in order to trigger a denial of
service, and possibly to run code.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

https://vigilance.fr/vulnerability/Linux-kernel-memory-corruption-via-InfiniBand-19549