From: "ira.weiny" <ira.weiny-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
To: Yann Droneaud <ydroneaud-RlY5vtjFyJ3QT0dZR+AlfA@public.gmane.org>
Cc: oss-security-ZwoEplunGu1jrUoiu81ncdBPR1lH4CV8@public.gmane.org,
Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
Red Hat Security Response Team
<secalert-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
Ben Hutchings <benh-8fiUuRrzOP0dnm+yROfE0A@public.gmane.org>,
linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: Re: [oss-security] CVE Request: Linux: IB/security: Restrict use of the write() interface'
Date: Wed, 11 May 2016 20:12:32 -0400 [thread overview]
Message-ID: <20160512001231.GB27943@phlsvsds.ph.intel.com> (raw)
In-Reply-To: <1462823339.4268.54.camel-RlY5vtjFyJ3QT0dZR+AlfA@public.gmane.org>
On Mon, May 09, 2016 at 09:48:59PM +0200, Yann Droneaud wrote:
> Hi,
>
>
> As a workaround, I would suggest that systems which do not require
> (userspace) RDMA/Infiniband to blacklist/remove the following modules:
>
> rdma_ucm
> ib_uverbs
> ib_ucm
> ib_umad
NOTE: AFAICT ib_umad is not vulnerable as it uses correct write/read semantics.
However, if you are disabling the other modules you probably have no use for
ib_umad either.
Ira
>
> For example, adds the following in /etc/modprobe.d/blacklist.conf
>
> blacklist rdma_ucm
> blacklist ib_uverbs
> blacklist ib_ucm
> blacklist ib_umad
>
> Those building their own kernel might want to disable, if not already,
>
> CONFIG_INFINIBAND_USER_ACCESS,
> CONFIG_INFINIBAND_USER_MAD,
> CONFIG_INFINIBAND_ADDR_TRANS
>
> (Unfortunately the last one will also disable those features:
> iSCSI Extensions for RDMA (iSER)
> iSCSI Extensions for RDMA (iSER) target support
> RDS over Infiniband and iWARP
> 9P RDMA Transport (Experimental)
> RPC-over-RDMA transport
> (which actually disable NFSoRDMA))
>
> Regards.
>
> --
> Yann Droneaud
> OPTEYA
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
prev parent reply other threads:[~2016-05-12 0:12 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20160507042232.GA5286@eldamar.local>
[not found] ` <20160507042232.GA5286-yvBWh1Eg28aNj9Bq2fkWzw@public.gmane.org>
2016-05-07 18:19 ` [oss-security] CVE Request: Linux: IB/security: Restrict use of the write() interface' Yann Droneaud
[not found] ` <1462645186.4268.27.camel-RlY5vtjFyJ3QT0dZR+AlfA@public.gmane.org>
2016-05-08 8:00 ` Christoph Hellwig
2016-05-09 18:02 ` Jann Horn
[not found] ` <20160509180208.GB6372-J1fxOzX/cBvk1uMJSBkQmQ@public.gmane.org>
2016-05-09 19:10 ` Yann Droneaud
[not found] ` <1462821041.4268.43.camel-RlY5vtjFyJ3QT0dZR+AlfA@public.gmane.org>
2016-05-09 19:39 ` Jann Horn
2016-05-09 19:48 ` Yann Droneaud
[not found] ` <1462823339.4268.54.camel-RlY5vtjFyJ3QT0dZR+AlfA@public.gmane.org>
2016-05-12 0:12 ` ira.weiny [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160512001231.GB27943@phlsvsds.ph.intel.com \
--to=ira.weiny-ral2jqcrhueavxtiumwx3w@public.gmane.org \
--cc=benh-8fiUuRrzOP0dnm+yROfE0A@public.gmane.org \
--cc=dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
--cc=linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=oss-security-ZwoEplunGu1jrUoiu81ncdBPR1lH4CV8@public.gmane.org \
--cc=secalert-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
--cc=ydroneaud-RlY5vtjFyJ3QT0dZR+AlfA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox