CVE-2023-52573

What it actually does

NULL pointer dereference in rds_rdma_cm_event_handler_cmn() when conn pointer is absent before passing it to rdma_set_service_type(), resulting in kernel crash.

Why it matters to the business

Local denial of service on Linux systems using RDS over RDMA, potentially disrupting network-dependent workloads and requiring reboots.

How an attack unfolds

An attacker with local access triggers an RDMA connection management event that reaches the handler without a valid conn structure, causing the unchecked dereference and kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 812da2a08dc5cc75fb71e29083ea20904510ac7a which adds the required conn pointer check before the rdma_set_service_type() call.

How to confirm the fix worked

Verify the presence of the NULL check for the conn pointer in rds_rdma_cm_event_handler_cmn() in the running kernel source or confirm the kernel build includes commit 812da2a08dc5cc75fb71e29083ea20904510ac7a.

Typical attack path

1. Obtain local access on affected Linux kernel
2. Trigger RDS RDMA connection management event path
3. Supply conditions that leave conn pointer NULL
4. Cause dereference in rdma_set_service_type() call
5. Induce kernel crash

How to detect it

Review kernel logs for oops or panic entries mentioning rds_rdma_cm_event_handler_cmn or rdma_set_service_type with NULL pointer dereference; correlate with RDS/RDMA activity.

• rds_rdma_cm_event_handler_cmn
• rdma_set_service_type
• NULL pointer dereference in RDS RDMA handler

What your security team should do

• Apply the kernel patch containing commit 812da2a08dc5cc75fb71e29083ea20904510ac7a immediately on all systems using RDS
• Prioritize systems exposing RDMA interfaces
• Monitor for kernel oops reports referencing RDS after patching