In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix a use after free in siw_alloc_mr
Our code analyzer reported a UAF.
In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a freed object. After, the execution continue up to the err_out branch of siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr).
My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {} section, to avoid the uaf.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 28, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 28, 2024 |
| Suse | — | Upgrade kernel-preemptUpgrade kernel-64kbUpgrade kernel-macrosUpgrade kernel-sourceUpgrade kernel-64kb-develUpgrade kernel-develUpgrade kernel-obs-buildUpgrade kernel-preempt-develUpgrade kernel-default-develUpgrade kernel-zfcpdumpUpgrade kernel-default-baseUpgrade kernel-docsUpgrade reiserfs-kmp-defaultUpgrade kernel-defaultUpgrade kernel-syms | Aug 9, 2024 | Feb 28, 2024 |
| Ubuntu | — | Upgrade linux-aws-fipsUpgrade linux-azure-fipsUpgrade linux-bluefieldUpgrade linux-oracleUpgrade linux-azure-5.4Upgrade linux-fipsUpgrade linux-gcp-fipsUpgrade linux-awsUpgrade linux-gkeopUpgrade linux-raspi-5.4Upgrade linux-gcpUpgrade linuxUpgrade linux-hwe-5.4Upgrade linux-gcp-5.4Upgrade linux-oracle-5.4Upgrade linux-kvmUpgrade linux-azureUpgrade linux-aws-5.4Upgrade linux-raspi | Nov 19, 2024 | Feb 28, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub