Linux Kernel up to 5.4.118/5.10.36/5.11.20/5.12.3 RDMA siw_alloc_mr use after free

Summaryinfo

A vulnerability classified as problematic was found in Linux Kernel up to 5.4.118/5.10.36/5.11.20/5.12.3. The affected element is the function siw_alloc_mr of the component RDMA. Executing a manipulation can lead to use after free. This vulnerability is tracked as CVE-2021-47012. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in Linux Kernel up to 5.4.118/5.10.36/5.11.20/5.12.3 (Operating System). This vulnerability affects the function siw_alloc_mr of the component RDMA. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix a use after free in siw_alloc_mr Our code analyzer reported a UAF. In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a freed object. After, the execution continue up to the err_out branch of siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr). My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {} section, to avoid the uaf.

The weakness was disclosed 02/28/2024. The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2021-47012 since 02/27/2024. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 239841 (TencentOS Server 4: kernel (TSSA-2024:0960)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.4.119, 5.10.37, 5.11.21, 5.12.4 or 5.13 eliminates this vulnerability. Applying the patch 30b9e92d0b5e/608a4b90ece0/3e22b88e02c1/ad9ce7188432/3093ee182f01 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (239841). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.4.118
• 5.10.0
• 5.10.1
• 5.10.2
• 5.10.3
• 5.10.4
• 5.10.5
• 5.10.6
• 5.10.7
• 5.10.8
• 5.10.9
• 5.10.10
• 5.10.11
• 5.10.12
• 5.10.13
• 5.10.14
• 5.10.15
• 5.10.16
• 5.10.17
• 5.10.18
• 5.10.19
• 5.10.20
• 5.10.21
• 5.10.22
• 5.10.23
• 5.10.24
• 5.10.25
• 5.10.26
• 5.10.27
• 5.10.28
• 5.10.29
• 5.10.30
• 5.10.31
• 5.10.32
• 5.10.33
• 5.10.34
• 5.10.35
• 5.10.36
• 5.11.0
• 5.11.1
• 5.11.2
• 5.11.3
• 5.11.4
• 5.11.5
• 5.11.6
• 5.11.7
• 5.11.8
• 5.11.9
• 5.11.10
• 5.11.11
• 5.11.12
• 5.11.13
• 5.11.14
• 5.11.15
• 5.11.16
• 5.11.17
• 5.11.18
• 5.11.19
• 5.11.20
• 5.12.0
• 5.12.1
• 5.12.2
• 5.12.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion