CVE-2024-35902

What it actually does

Null pointer dereference in __rds_rdma_map when cp parameter is NULL, triggered after get_mr returns ERR_PTR, causing kernel crash (denial of service).

Why it matters to the business

Local denial of service on affected Linux systems using RDS transport, potentially disrupting workloads or services on hosts with local access; low urgency given age and low exploitability metrics.

How an attack unfolds

Local attacker invokes rds_get_mr or rds_get_mr_for_dest which pass NULL cp to __rds_rdma_map; when get_mr (e.g., rds_ib_get_mr) returns -ENODEV error, the subsequent code path dereferences the null cp leading to panic.

How to fix it

Upgrade Linux kernel to fixed versions including 4.19.312 or commit d275de8ea7be3a453629fddae41d4156762e814c (and equivalent stable backports) in all affected distributions.

How to confirm the fix worked

Verify running kernel version is at or above the listed fixed releases; inspect source for the added NULL check on cp before cp->cp_conn usage in __rds_rdma_map.

Typical attack path

1. Obtain local user access on target Linux system
2. Load or use RDS sockets and call get_mr paths with conditions that result in NULL cp
3. Trigger error return from transport get_mr implementation
4. Execute the unguarded cp->cp_conn dereference causing kernel oops/panic

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log) for oops/panic traces mentioning rds, __rds_rdma_map, or cp_conn null dereference; correlate with process activity using RDS sockets.

What your security team should do

• Apply kernel updates to fixed versions on all systems using RDS
• Review and restrict local RDS socket usage if patching is delayed
• Monitor for kernel crashes related to rds_rdma_map in system logs