In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Set send and receive CQ before forwarding to the driver
Preset both receive and send CQ pointers prior to call to the drivers and overwrite it later again till the mlx4 is going to be changed do not overwrite ibqp properties.
This change is needed for mlx5, because in case of QP creation failure, it will go to the path of QP destroy which relies on proper CQ pointers.
BUG: KASAN: use-after-free in create_qp.cold+0x164/0x16e [mlx5_ib] Write of size 8 at addr ffff8880064c55c0 by task a.out/246
CPU: 0 PID: 246 Comm: a.out Not tainted 5.15.0+ #291 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x45/0x59 print_address_description.constprop.0+0x1f/0x140 kasan_report.cold+0x83/0xdf create_qp.cold+0x164/0x16e [mlx5_ib] mlx5_ib_create_qp+0x358/0x28a0 [mlx5_ib] create_qp.part.0+0x45b/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
Allocated by task 246: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0xa4/0xd0 create_qp.part.0+0x92/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
Freed by task 246: kasan_save_stack+0x1b/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0x10c/0x150 slab_free_freelist_hook+0xb4/0x1b0 kfree+0xe7/0x2a0 create_qp.part.0+0x52b/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade reiserfs-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade dtb-appleUpgrade kernel-rt_debugUpgrade kernel-azure-extraUpgrade dlm-kmp-defaultUpgrade dtb-nvidiaUpgrade gfs2-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-vdsoUpgrade kernel-defaultUpgrade kernel-macrosUpgrade dtb-marvellUpgrade kernel-rt-optionalUpgrade kernel-64kb-optionalUpgrade kernel-64kbUpgrade kernel-debugUpgrade kernel-docsUpgrade kernel-rt_debug-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-docs-htmlUpgrade kernel-default-baseUpgrade dtb-apmUpgrade dtb-freescaleUpgrade cluster-md-kmp-defaultUpgrade kernel-default-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-obs-qaUpgrade kernel-source-rtUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-socionextUpgrade dtb-renesasUpgrade kernel-default-extraUpgrade dtb-amazonUpgrade dtb-amdUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-azureUpgrade dlm-kmp-azureUpgrade kernel-syms-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-debug-develUpgrade dlm-kmp-rtUpgrade dtb-sprdUpgrade dtb-amlogicUpgrade dtb-broadcomUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kb-develUpgrade dtb-exynosUpgrade kernel-kvmsmallUpgrade dtb-armUpgrade kernel-devel-azureUpgrade kernel-azureUpgrade kernel-rt-develUpgrade kernel-azure-livepatch-develUpgrade kernel-symsUpgrade dtb-qcomUpgrade cluster-md-kmp-rtUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-rtUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-azureUpgrade dtb-caviumUpgrade ocfs2-kmp-azureUpgrade dtb-alteraUpgrade kernel-source-azureUpgrade kernel-default-optionalUpgrade dtb-allwinnerUpgrade kernel-zfcpdumpUpgrade dtb-mediatekUpgrade kernel-azure-optionalUpgrade gfs2-kmp-defaultUpgrade kernel-rt-livepatchUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade kernel-azure-develUpgrade cluster-md-kmp-azureUpgrade kernel-sourceUpgrade kselftests-kmp-64kbUpgrade kernel-devel-rtUpgrade kernel-obs-buildUpgrade kernel-default-vdsoUpgrade gfs2-kmp-azureUpgrade dtb-rockchipUpgrade kernel-rt-extraUpgrade kernel-develUpgrade kernel-source-vanillaUpgrade ocfs2-kmp-defaultUpgrade dtb-lgUpgrade dtb-xilinxUpgrade kernel-syms-azure | Aug 9, 2024 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub