A NULL pointer dereference in the RDS connection code when sending a message to an apparently unbound socket in net/rds/connection.c was found. The problem is caused by the code checking if the socket is bound in rds_sendmsg(), which checks the rs_bound_addr field without taking a lock on the socket.  This opens a race where rs_bound_addr is temporarily set but where the transport is not in rds_bind(), leading to a NULL pointer dereference when trying to dereference 'trans' in __rds_conn_create().

Note that this is a complete fix of CVE-2015-6937 issue.

Patch can be found here:

https://lkml.org/lkml/2015/10/16/530

CVE assignment:

http://seclists.org/oss-sec/2015/q4/179

Workaround:

The Linux kernel will attempt to automatically load the RDS module when the RDS protocol is used from userspace.  The module can be prevented being loaded with the commands:

echo "install rds /bin/true" > /etc/modprobe.d/disable-rds
echo "alias net-pf-28 off" >> /etc/modprobe.d/disable-rds

Earlier versions of Red Hat Enterprise Linux can be disabled with instructions from here: https://access.redhat.com/solutions/41278 

If the module is already loaded prior to this, it must be removed or the system must be rebooted to preven it loading in the future.