Bug 2058955 (CVE-2022-0812)

Summary:	CVE-2022-0812 kernel: NFS over RDMA random memory leakage
Product:	[Other] Security Response	Reporter:	Rohit Keshri <rkeshri>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bcodding, bhu, brdeoliv, bskeggs, chwhite, crwood, dhoward, dvlasenk, eshatokhin, fhrbata, hdegoede, hkrzesin, jarod, jarodwilson, jburrell, jeremy, jfaracco, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, lzampier, masami256, mchehab, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, smayhew, steve.beattie, steved, vkumar, walters, williams, yozone, zulinx86
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux Kernel. This flaw allows an attacker with normal user privileges to leak kernel information.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-07-05 20:24:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2059090, 2059091, 2059092, 2059093, 2059094
Bug Blocks:	2058774, 2059497

Description Rohit Keshri 2022-02-27 07:11:20 UTC

when a file read from nfsrdma is less than 700 bytes, it contains random parts of memory, it is observed that the files were not just corrupted, but contained part of the memory, from other files in the NFS filesystem to .data from the kernel.

Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=2058361

Comment 5 Rohit Keshri 2022-02-28 07:59:24 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2059094]

Comment 10 Steve Beattie 2022-03-19 08:51:28 UTC

Hi, are there any more details about this issue? Has a fix for this landed upstream? Looking at the relevant functions, it seems like

  912288442cb2 ("xprtrdma: fix incorrect header size calculations")

might be the fix for this?

Thanks!

Comment 11 Rohit Keshri 2022-03-19 15:35:13 UTC

Hi, thank you for sharing this, I have not heard about this being fixed in the upstream, but this patch is definitely adjusting the size error, which was seen in the problem.

Comment 17 Justin M. Forbes 2022-06-29 16:29:46 UTC

This was fixed for Fedora with the 5.7.10 stable kernel updates

Comment 18 Scott Mayhew 2022-07-05 20:24:55 UTC

Closing NOTABUG.  The only way to hit this is by running against a RHEL 7.2 and earlier NFS server where server-side NFSoRDMA was Tech Preview (i.e. unsupported).  

See

https://bugzilla.redhat.com/show_bug.cgi?id=2058361#c8
https://bugzilla.redhat.com/show_bug.cgi?id=2058955#c15
https://bugzilla.redhat.com/show_bug.cgi?id=2058955#c16

for more detail.