ReDMArk: Bypassing RDMA Security Mechanisms.

A framework for security analysis of RDMA networking. This is the source code for our USENIX Security paper.

Discovered vulnerabilities

• (V1) Memory Protection Key Randomness. See rkey_tests/.
• (V2) Static Initialization State for Key Generation. See rkey_tests/.
• (V3) Shared Key Generator. See rkey_tests/.
• (V4) Consecutive Allocation of Memory Regions. See allocation_addr_tests/.
• (V5) Linearly Increasing QP Numbers. See qp_tests/.
• (V6) Fixed Starting Packet Sequence Number. See USENIX Security paper.
• (V7) Limited Attack Detection Capabilities. See USENIX Security paper.
• (V8) Missing Encryption and Authentication in RDMA Protocols. See USENIX Security paper.
• (V9) Single Protection Domain for all QPs. See USENIX Security paper.
• (V10) Implicit On-Demand Paging (ODP). See USENIX Security paper.

Implemented attacks

• (A1) Packet Injection using Impersonation. See inject_attack/.
• (A2) DoS Attack by Transiting QPs to an Error State. See inject_attack/.
• (A3) Unauthorized Memory Access. See USENIX Security paper.
• (A4) DoS Attack based on Queue Pair Allocation Resource Exhaustion. See qp_tests/.
• (A5) Performance Degradation using Resource Exhaustion. See exhaustion_attack/.
• (A6) Facilitating Attacks using RDMA. See preload_attack/.

Citing this work

If you use our code, please consider citing our USENIX Security paper:

@inproceedings{rot2021redmark,
  title={{ReDMArk}: Bypassing {RDMA} Security Mechanisms},
  author={Benjamin Rothenberger and Konstantin Taranov and Adrian Perrig and Torsten Hoefler},
  booktitle={{USENIX} Security Symposium ({USENIX} Security 21)},
  year={2021},
}

Contact

Konstantin Taranov (konstantin.taranov "at" inf.ethz.ch)
Benjamin Rothenberger (benjamin.rothenberger "at" inf.ethz.ch)