In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Set send and receive CQ before forwarding to the driver
Preset both receive and send CQ pointers prior to call to the drivers and overwrite it later again till the mlx4 is going to be changed do not overwrite ibqp properties.
This change is needed for mlx5, because in case of QP creation failure, it will go to the path of QP destroy which relies on proper CQ pointers.
BUG: KASAN: use-after-free in create_qp.cold+0x164/0x16e [mlx5_ib] Write of size 8 at addr ffff8880064c55c0 by task a.out/246
CPU: 0 PID: 246 Comm: a.out Not tainted 5.15.0+ #291 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x45/0x59 print_address_description.constprop.0+0x1f/0x140 kasan_report.cold+0x83/0xdf create_qp.cold+0x164/0x16e [mlx5_ib] mlx5_ib_create_qp+0x358/0x28a0 [mlx5_ib] create_qp.part.0+0x45b/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
Allocated by task 246: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0xa4/0xd0 create_qp.part.0+0x92/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
Freed by task 246: kasan_save_stack+0x1b/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0x10c/0x150 slab_free_freelist_hook+0xb4/0x1b0 kfree+0xe7/0x2a0 create_qp.part.0+0x52b/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade kernel-zfcpdumpUpgrade kernel-devel-azureUpgrade kernel-kvmsmallUpgrade kernel-syms-azureUpgrade dtb-armUpgrade dtb-xilinxUpgrade kernel-azureUpgrade kernel-rt-develUpgrade kernel-64kb-develUpgrade ocfs2-kmp-azureUpgrade kernel-symsUpgrade kernel-rt_debug-develUpgrade kernel-source-vanillaUpgrade kernel-develUpgrade kernel-default-optionalUpgrade dtb-alteraUpgrade ocfs2-kmp-defaultUpgrade dtb-lgUpgrade dtb-caviumUpgrade ocfs2-kmp-rtUpgrade kernel-default-base-rebuildUpgrade dtb-allwinnerUpgrade gfs2-kmp-defaultUpgrade kernel-sourceUpgrade kselftests-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kernel-source-azureUpgrade reiserfs-kmp-azureUpgrade dtb-mediatekUpgrade cluster-md-kmp-azureUpgrade kernel-rt-extraUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-azureUpgrade kernel-obs-buildUpgrade dlm-kmp-64kbUpgrade dtb-exynosUpgrade kernel-default-vdsoUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-rtUpgrade kernel-azure-develUpgrade dtb-rockchipUpgrade kernel-devel-rtUpgrade kernel-rtUpgrade kernel-azure-optionalUpgrade dtb-qcomUpgrade gfs2-kmp-64kbUpgrade kernel-debugUpgrade reiserfs-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-defaultUpgrade dtb-appleUpgrade kernel-64kbUpgrade dtb-nvidiaUpgrade kernel-syms-rtUpgrade kernel-64kb-livepatch-develUpgrade dtb-broadcomUpgrade kernel-source-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-default-baseUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-docsUpgrade kernel-rt_debugUpgrade kernel-azure-extraUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-default-develUpgrade cluster-md-kmp-64kbUpgrade dtb-renesasUpgrade kernel-macrosUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-debug-vdsoUpgrade dtb-sprdUpgrade dtb-socionextUpgrade dtb-amdUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-extraUpgrade reiserfs-kmp-defaultUpgrade dtb-apmUpgrade dlm-kmp-rtUpgrade kernel-debug-livepatch-develUpgrade dtb-hisiliconUpgrade dtb-freescaleUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-extraUpgrade kernel-default-livepatch-develUpgrade kernel-default-livepatchUpgrade kernel-obs-qaUpgrade dtb-amazonUpgrade kernel-64kb-optionalUpgrade dlm-kmp-azureUpgrade kernel-debug-develUpgrade dtb-amlogicUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-azureUpgrade dtb-marvellUpgrade kselftests-kmp-defaultUpgrade kernel-azure-vdso | Aug 9, 2024 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub