Description
ibacm before 1.0.6 does not properly manage reference counts for multicast connections, which allows remote attackers to cause a denial of service (ibacm service crash) via a crafted join response.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | ibacm +1 | 1.0.8-0.git7a3adb7.el6 | RHSA-2013:0509 |
| RHEL 6 | ibsim | 0.5-7.el6 | RHSA-2013:0509 |
| RHEL 6 | ibutils +2 | 1.5.7-7.el6 | RHSA-2013:0509 |
| RHEL 6 | infiniband-diags +2 | 1.5.12-5.el6 | RHSA-2013:0509 |
| RHEL 6 | infinipath-psm +1 | 3.0.1-115.1015_open.1.el6 | RHSA-2013:0509 |
| RHEL 6 | libibmad +2 | 1.3.9-1.el6 | RHSA-2013:0509 |
| RHEL 6 | libibumad +2 | 1.3.8-1.el6 | RHSA-2013:0509 |
| RHEL 6 | libibverbs +3 | 1.1.6-5.el6 | RHSA-2013:0509 |
| RHEL 6 | libmlx4 +1 | 1.0.4-1.el6 | RHSA-2013:0509 |
| RHEL 6 | librdmacm +3 | 1.0.17-0.git4b5c1aa.el6 | RHSA-2013:0509 |
| RHEL 6 | opensm +3 | 3.3.15-1.el6 | RHSA-2013:0509 |
| RHEL 6 | rdma | 3.6-1.el6 | RHSA-2013:0509 |
Advisories 1
- RHSA-2013:0509 Red Hat Security Advisory: rdma security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- http://git.openfabrics.org/git?p=~shefty/ibacm.git%3Ba=commit%3Bh=c7d28b35d64333c262de3ec972c426423dadccf9
- RHSA-2013:0509 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=865492
- [oss-security] 20121011 CVE Request -- librdmacm (one issue) / ibacm (two issues) mailing-list
- ibacm-connections-dos(79396) vdb-entry
- [linux-rdma] 20120413 [ANNOUNCE] ibacm release 1.0.6 mailing-list
- [oss-security] 20121011 Re: CVE Request -- librdmacm (one issue) / ibacm (two issues) mailing-list
- 55890 vdb-entry