Description
librdmacm 1.0.16, when ibacm.port is not specified, connects to port 6125, which allows remote attackers to specify the address resolution information for the application via a malicious ib_acm service.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | librdmacm | 1.0.16-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | ibutils +2 | 1.5.7-8.el6 | RHSA-2013:1661 |
| RHEL 6 | infinipath-psm +1 | 3.0.1-115.1015_open.2.el6 | RHSA-2013:1661 |
| RHEL 6 | libibverbs +3 | 1.1.7-1.el6 | RHSA-2013:1661 |
| RHEL 6 | libmlx4 +1 | 1.0.5-4.el6.1 | RHSA-2013:1661 |
| RHEL 6 | librdmacm +3 | 1.0.17-1.el6 | RHSA-2013:1661 |
| RHEL 6 | mpitests +5 | 3.2-9.el6 | RHSA-2013:1661 |
| RHEL 6 | mstflint | 3.0-0.6.g6961daa.1.el6 | RHSA-2013:1661 |
| RHEL 6 | openmpi +1 | 1.5.4-2.el6 | RHSA-2013:1661 |
| RHEL 6 | perftest | 2.0-2.el6 | RHSA-2013:1661 |
| RHEL 6 | qperf | 0.4.9-1.el6 | RHSA-2013:1661 |
| RHEL 6 | rdma | 3.10-3.el6 | RHSA-2013:1661 |
Advisories 1
- RHSA-2013:1661 Red Hat Security Advisory: RDMA stack security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=865483
- [oss-security] 20121011 CVE Request -- librdmacm (one issue) / ibacm (two issues) mailing-list
- http://git.openfabrics.org/git?p=~shefty/librdmacm.git%3Ba=commitdiff%3Bh=4b5c1aa734e0e734fc2ba3cd41d0ddf02170af6d
- [oss-security] 20121011 Re: CVE Request -- librdmacm (one issue) / ibacm (two issues) mailing-list
- 55896 vdb-entry