In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Set send and receive CQ before forwarding to the driver
Preset both receive and send CQ pointers prior to call to the drivers and overwrite it later again till the mlx4 is going to be changed do not overwrite ibqp properties.
This change is needed for mlx5, because in case of QP creation failure, it will go to the path of QP destroy which relies on proper CQ pointers.
BUG: KASAN: use-after-free in create_qp.cold+0x164/0x16e [mlx5_ib] Write of size 8 at addr ffff8880064c55c0 by task a.out/246
CPU: 0 PID: 246 Comm: a.out Not tainted 5.15.0+ #291 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x45/0x59 print_address_description.constprop.0+0x1f/0x140 kasan_report.cold+0x83/0xdf create_qp.cold+0x164/0x16e [mlx5_ib] mlx5_ib_create_qp+0x358/0x28a0 [mlx5_ib] create_qp.part.0+0x45b/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
Allocated by task 246: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0xa4/0xd0 create_qp.part.0+0x92/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
Freed by task 246: kasan_save_stack+0x1b/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0x10c/0x150 slab_free_freelist_hook+0xb4/0x1b0 kfree+0xe7/0x2a0 create_qp.part.0+0x52b/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade ocfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-symsUpgrade kernel-azure-optionalUpgrade kernel-source-vanillaUpgrade ocfs2-kmp-azureUpgrade kernel-zfcpdumpUpgrade dtb-alteraUpgrade kselftests-kmp-64kbUpgrade dtb-xilinxUpgrade dtb-lgUpgrade kernel-default-optionalUpgrade dtb-exynosUpgrade kernel-rt-develUpgrade kernel-syms-azureUpgrade dtb-armUpgrade cluster-md-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-develUpgrade kernel-sourceUpgrade kernel-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-develUpgrade kernel-64kb-develUpgrade kernel-azureUpgrade kernel-devel-azureUpgrade reiserfs-kmp-azureUpgrade kernel-default-vdsoUpgrade gfs2-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-rt-extraUpgrade kernel-azure-develUpgrade dtb-rockchipUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-rt-livepatchUpgrade kernel-source-azureUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-rtUpgrade dtb-caviumUpgrade kernel-kvmsmall-develUpgrade kernel-default-base-rebuildUpgrade kernel-azure-livepatch-develUpgrade dtb-mediatekUpgrade dtb-qcomUpgrade kernel-obs-buildUpgrade kernel-default-extraUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-livepatchUpgrade dtb-renesasUpgrade dlm-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-default-livepatch-develUpgrade kernel-64kbUpgrade dtb-freescaleUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-default-baseUpgrade dtb-amdUpgrade dtb-socionextUpgrade kernel-kvmsmall-vdsoUpgrade dtb-sprdUpgrade dtb-amazonUpgrade kernel-rt_debug-vdsoUpgrade kernel-docsUpgrade dtb-marvellUpgrade kernel-debugUpgrade dtb-amlogicUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-defaultUpgrade kernel-64kb-optionalUpgrade kernel-rt-optionalUpgrade kernel-azure-extraUpgrade dtb-appleUpgrade kernel-debug-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debugUpgrade kernel-macrosUpgrade kernel-source-rtUpgrade dtb-nvidiaUpgrade kernel-azure-vdsoUpgrade kernel-rt-vdsoUpgrade dtb-hisiliconUpgrade gfs2-kmp-64kbUpgrade dtb-apmUpgrade kernel-default-develUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-rtUpgrade dtb-broadcomUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-obs-qaUpgrade kernel-rt_debug-livepatch-devel | Aug 9, 2024 | Apr 10, 2024 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub