NeVerMore: Exploiting RDMA Mistakes in NVMe-oF Storage Applications

TL;DR

This paper uncovers security vulnerabilities in RDMA and NVMe-oF protocols, demonstrating how unprivileged users can inject packets and access storage devices, and proposes mitigation mechanisms.

Contribution

It identifies new security flaws in RDMA and NVMe-oF protocols and provides practical attack implementations and potential countermeasures.

Findings

Four RDMA protocol attacks demonstrated

Seven NVMe-oF protocol attacks verified

Proposed mitigation mechanisms for RDMA and NVMe-oF security

Abstract

This paper presents a security analysis of the InfiniBand architecture, a prevalent RDMA standard, and NVMe-over-Fabrics (NVMe-oF), a prominent protocol for industrial disaggregated storage that exploits RDMA protocols to achieve low-latency and high-bandwidth access to remote solid-state devices. Our work, NeVerMore, discovers new vulnerabilities in RDMA protocols that unveils several attack vectors on RDMA-enabled applications and the NVMe-oF protocol, showing that the current security mechanisms of the NVMe-oF protocol do not address the security vulnerabilities posed by the use of RDMA. In particular, we show how an unprivileged user can inject packets into any RDMA connection created on a local network controller, bypassing security mechanisms of the operating system and its kernel, and how the injection can be used to acquire unauthorized block access to NVMe-oF devices. Overall, we implement four attacks on RDMA protocols and seven attacks on the NVMe-oF protocol and verify them on the two most popular implementations of NVMe-oF: SPDK and the Linux kernel. To mitigate the discovered attacks we propose multiple mechanisms that can be implemented by RDMA and NVMe-oF providers.