In the Linux kernel, the following vulnerability has been resolved:
xprtrdma: Fix bcall rep leak and unbounded peek
rpcrdma_is_bcall() decodes a reply's first words to decide whether
the frame is a backchannel call. Two issues in that decode path
let a short or malformed reply leak the receive buffer and drain
the Receive queue.
First, the speculative peek
<pre>
p = xdr_inline_decode(xdr, 0);
/* five p++ reads follow */
</pre>
asks xdr_inline_decode() for zero bytes, which returns xdr->p
without consulting xdr->end. The five subsequent __be32 reads can
then walk up to 20 bytes past the wire payload into stale regbuf
contents and misclassify the reply as a backchannel call.
Second, after the post-peek
<pre>
p = xdr_inline_decode(xdr, 3 * sizeof(*p));
if (unlikely(!p))
return true;
</pre>
the short-header arm returns true without calling
rpcrdma_bc_receive_call(). The contract with the caller is that a
true return transfers ownership of rep to the backchannel path:
<pre>
rpcrdma_reply_handler()
if (rpcrdma_is_bcall(r_xprt, rep))
return; /* bare return, skips out_post */
...
out_post:
rpcrdma_post_recvs(r_xprt, credits + ...);
</pre>
Because rpcrdma_bc_receive_call() never ran, no one took rep, but
rpcrdma_reply_handler still bare-returns past rpcrdma_rep_put()
and rpcrdma_post_recvs(). The rep, with its persistently
DMA-mapped receive buffer, is orphaned on rb_all_reps and freed
only at transport teardown. This completion reposts nothing, so
its slot is reclaimed only when a later forward-channel reply
reaches out_post and rpcrdma_post_recvs() allocates a fresh rep to
backfill; absent that traffic the Receive queue drains and the
peer's Sends draw RNR NAKs.
Fix by consulting xdr->end after the zero-length peek so the five
__be32 reads cannot run unless 20 bytes of wire payload remain. A
byte-precise comparison against xdr->end is required because a
non-4-aligned receive rounds the stream's word count up past the
true payload. Also return false from the short-header arm so the
reply falls through the normal out_norqst cleanup chain
(rpcrdma_rep_put() plus rpcrdma_post_recvs()).
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The bug is reached when a remote RDMA peer's inbound message completes in rpcrdma_wc_receive() and rpcrdma_reply_handler() decodes it; a malicious or compromised NFS-over-RDMA server can send crafted short rdma_msg replies over the established RPC/RDMA connection without local access.
AC:L - On an active NFSv4.1+ RPC/RDMA session the attacker fully controls inbound replies and can repeatedly send short/malformed rdma_msg frames to hit the zero-length peek and short-header return-true paths, reliably leaking receive buffers and draining the Receive queue.
PR:N - Exploitation requires only network reachability as the connected RDMA/RPC peer (e.g., a malicious NFS server); no local account, mount privileges, or namespaced capabilities on the victim NFS client are needed to deliver the malformed RDMA replies.
UI:N - Once an NFS-over-RDMA mount and NFSv4.1 backchannel session exist, triggering the flaw needs no additional victim action beyond the attacker sending malicious RDMA receive payloads during normal client-server communication.
S:U - The vulnerability and its impact remain within the NFS client's kernel SUNRPC/xprtrdma transport context; it does not cross a VM, container, or IOMMU security boundary to affect other authorities.
C:H - xdr_inline_decode(xdr,0) permits up to five subsequent __be32 reads past the wire payload into stale receive-buffer contents, an out-of-bounds read that can misclassify replies and expose remnants of prior RPC/NFS data to unintended processing paths.
I:H - Stale-buffer-assisted misclassification can treat a forward-channel reply as a backchannel RPC_CALL, a type confusion that routes attacker-influenced bytes into rpcrdma_bc_receive_call()/NFSv4 callback handling and can corrupt client session state.
A:H - Each successful trigger orphans a DMA-mapped rpcrdma_rep and skips rpcrdma_post_recvs(), monotonically draining the RDMA Receive queue until the peer gets RNR NAKs and the NFS-over-RDMA connection becomes unusable, enabling sustained remote denial of service.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The bug is reached when a remote RDMA peer's inbound message completes in rpcrdma_wc_receive() and rpcrdma_reply_handler() decodes it; a malicious or compromised NFS-over-RDMA server can send crafted short rdma_msg replies over the established RPC/RDMA connection without local access.
AC:L - On an active NFSv4.1+ RPC/RDMA session the attacker fully controls inbound replies and can repeatedly send short/malformed rdma_msg frames to hit the zero-length peek and short-header return-true paths, reliably leaking receive buffers and draining the Receive queue.
PR:N - Exploitation requires only network reachability as the connected RDMA/RPC peer (e.g., a malicious NFS server); no local account, mount privileges, or namespaced capabilities on the victim NFS client are needed to deliver the malformed RDMA replies.
UI:N - Once an NFS-over-RDMA mount and NFSv4.1 backchannel session exist, triggering the flaw needs no additional victim action beyond the attacker sending malicious RDMA receive payloads during normal client-server communication.
S:U - The vulnerability and its impact remain within the NFS client's kernel SUNRPC/xprtrdma transport context; it does not cross a VM, container, or IOMMU security boundary to affect other authorities.
C:H - xdr_inline_decode(xdr,0) permits up to five subsequent __be32 reads past the wire payload into stale receive-buffer contents, an out-of-bounds read that can misclassify replies and expose remnants of prior RPC/NFS data to unintended processing paths.
I:H - Stale-buffer-assisted misclassification can treat a forward-channel reply as a backchannel RPC_CALL, a type confusion that routes attacker-influenced bytes into rpcrdma_bc_receive_call()/NFSv4 callback handling and can corrupt client session state.
A:H - Each successful trigger orphans a DMA-mapped rpcrdma_rep and skips rpcrdma_post_recvs(), monotonically draining the RDMA Receive queue until the peer gets RNR NAKs and the NFS-over-RDMA connection becomes unusable, enabling sustained remote denial of service.
CVSS 3.1