In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Set send and receive CQ before forwarding to the driver
Preset both receive and send CQ pointers prior to call to the drivers and overwrite it later again till the mlx4 is going to be changed do not overwrite ibqp properties.
This change is needed for mlx5, because in case of QP creation failure, it will go to the path of QP destroy which relies on proper CQ pointers.
BUG: KASAN: use-after-free in create_qp.cold+0x164/0x16e [mlx5_ib] Write of size 8 at addr ffff8880064c55c0 by task a.out/246
CPU: 0 PID: 246 Comm: a.out Not tainted 5.15.0+ #291 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x45/0x59 print_address_description.constprop.0+0x1f/0x140 kasan_report.cold+0x83/0xdf create_qp.cold+0x164/0x16e [mlx5_ib] mlx5_ib_create_qp+0x358/0x28a0 [mlx5_ib] create_qp.part.0+0x45b/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
Allocated by task 246: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0xa4/0xd0 create_qp.part.0+0x92/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
Freed by task 246: kasan_save_stack+0x1b/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0x10c/0x150 slab_free_freelist_hook+0xb4/0x1b0 kfree+0xe7/0x2a0 create_qp.part.0+0x52b/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade kernel-64kb-optionalUpgrade cluster-md-kmp-defaultUpgrade dtb-renesasUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-rtUpgrade dtb-hisiliconUpgrade dtb-sprdUpgrade dtb-appleUpgrade kernel-debug-develUpgrade kernel-rt_debugUpgrade kernel-debug-vdsoUpgrade kernel-source-rtUpgrade reiserfs-kmp-64kbUpgrade dtb-amazonUpgrade kernel-azure-extraUpgrade dtb-amdUpgrade dtb-socionextUpgrade kernel-default-extraUpgrade dtb-marvellUpgrade dtb-broadcomUpgrade dlm-kmp-defaultUpgrade kernel-docsUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-syms-rtUpgrade kernel-debugUpgrade kselftests-kmp-azureUpgrade kernel-rt-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-macrosUpgrade reiserfs-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-64kbUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-defaultUpgrade dlm-kmp-azureUpgrade dtb-nvidiaUpgrade kernel-rt-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-default-develUpgrade kernel-obs-qaUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-default-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-debug-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-default-baseUpgrade dtb-freescaleUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade dtb-qcomUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-rtUpgrade kernel-symsUpgrade ocfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-sourceUpgrade kernel-rt-extraUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-rtUpgrade kernel-azure-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-devel-rtUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-azureUpgrade dtb-caviumUpgrade kernel-azure-optionalUpgrade dtb-mediatekUpgrade dtb-exynosUpgrade dtb-allwinnerUpgrade kernel-develUpgrade gfs2-kmp-defaultUpgrade kernel-azure-develUpgrade kselftests-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-obs-buildUpgrade dtb-rockchipUpgrade kernel-source-azureUpgrade ocfs2-kmp-azureUpgrade kernel-default-optionalUpgrade dtb-alteraUpgrade kernel-zfcpdumpUpgrade dtb-lgUpgrade kernel-azureUpgrade kernel-64kb-develUpgrade dtb-armUpgrade dtb-xilinxUpgrade kernel-syms-azureUpgrade kernel-rt-develUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-develUpgrade kernel-rt-livepatch | Aug 9, 2024 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub