CVE-2016-5244

What it actually does

The rds_inc_info_copy function in net/rds/recv.c fails to initialize a structure member, causing uninitialized kernel stack memory to be copied into RDS message responses and disclosed to remote readers.

Why it matters to the business

Remote attackers can obtain sensitive kernel memory contents that may include credentials or internal data structures, raising the risk of follow-on attacks on Linux systems that use the RDS protocol; the flaw has been fixed for years and carries low current urgency.

How an attack unfolds

An attacker sends a crafted RDS message to a target system; the vulnerable copy function returns uninitialized stack bytes in the reply, allowing the attacker to harvest kernel memory for useful information such as pointers or credentials.

How to fix it

Upgrade the Linux kernel to a version that includes commit 4116def2337991b39919f3b448326e21c40e0dbb; disable the RDS module if it is not required for operation.

How to confirm the fix worked

Confirm the presence of commit 4116def2337991b39919f3b448326e21c40e0dbb in the kernel source tree or run a proof-of-concept that exercises rds_inc_info_copy and verifies the structure member is now zeroed.

Typical attack path

1. Locate Linux systems exposing the RDS protocol
2. Transmit a minimal RDS message crafted to invoke rds_inc_info_copy
3. Capture and parse the response to extract leaked kernel stack contents
4. Use recovered data to advance further attacks such as credential reuse or memory layout discovery

How to detect it

Search network flow logs and system audit records for unexpected RDS protocol traffic; examine kernel logs around the time of unusual message sizes or responses that could indicate memory disclosure attempts.

What your security team should do

• Apply the referenced kernel commit on any remaining unpatched systems
• Restrict or disable RDS where possible through module blacklisting
• Review network segmentation to limit exposure of RDS ports