In the Linux kernel, the following vulnerability has been resolved:
xprtrdma: Fix cwnd update ordering
After a reconnect, the reply handler is opening the cwnd (and thus enabling more RPC Calls to be sent) /before/ rpcrdma_post_recvs() can post enough Receive WRs to receive their replies. This causes an RNR and the new connection is lost immediately.
The race is most clearly exposed when KASAN and disconnect injection are enabled. This slows down rpcrdma_rep_create() enough to allow the send side to post a bunch of RPC Calls before the Receive completion handler can invoke ib_post_recv().
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade perf-debuginfoUpgrade perf | May 28, 2024 | Feb 28, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 28, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 28, 2024 |
| Suse | — | Upgrade kernel-defaultUpgrade kernel-symsUpgrade kernel-docsUpgrade kernel-default-baseUpgrade kernel-macrosUpgrade reiserfs-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-preempt-develUpgrade kernel-obs-buildUpgrade kernel-sourceUpgrade kernel-64kbUpgrade kernel-64kb-develUpgrade kernel-develUpgrade kernel-preemptUpgrade kernel-default-devel | Aug 9, 2024 | Feb 28, 2024 |
| Ubuntu | — | Upgrade linux-image-5.4.0-1084-ibmUpgrade linux-image-raspiUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-gcpUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1142-azureUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.4.0-204-genericUpgrade linux-image-oem-osp1Upgrade linux-image-azureUpgrade linux-image-5.4.0-1097-bluefieldUpgrade linux-image-5.4.0-1125-kvmUpgrade linux-image-5.4.0-1056-xilinx-zynqmpUpgrade linux-image-kvmUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-genericUpgrade linux-image-5.4.0-1121-raspiUpgrade linux-image-raspi2Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-1141-gcpUpgrade linux-image-virtualUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.4.0-1136-oracleUpgrade linux-image-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-bluefieldUpgrade linux-image-generic-lpaeUpgrade linux-image-5.4.0-204-generic-lpaeUpgrade linux-image-5.4.0-204-lowlatencyUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-azure-lts-20.04Upgrade linux-image-oemUpgrade linux-image-aws-lts-20.04Upgrade linux-image-awsUpgrade linux-image-oracleUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.4.0-1137-awsUpgrade linux-image-oracle-lts-20.04 | Dec 18, 2024 | Feb 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub