In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Initialize the ODP xarray when creating an ODP MR
Normally the zero fill would hide the missing initialization, but an errant set to desc_size in reg_create() causes a crash:
BUG: unable to handle page fault for address: 0000000800000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 5 PID: 890 Comm: ib_write_bw Not tainted 5.15.0-rc4+ #47 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5_ib_dereg_mr+0x14/0x3b0 [mlx5_ib] Code: 48 63 cd 4c 89 f7 48 89 0c 24 e8 37 30 03 e1 48 8b 0c 24 eb a0 90 0f 1f 44 00 00 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 30 <48> 8b 2f 65 48 8b 04 25 28 00 00 00 48 89 44 24 28 31 c0 8b 87 c8 RSP: 0018:ffff88811afa3a60 EFLAGS: 00010286 RAX: 000000000000001c RBX: 0000000800000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000800000000 RBP: 0000000800000000 R08: 0000000000000000 R09: c0000000fffff7ff R10: ffff88811afa38f8 R11: ffff88811afa38f0 R12: ffffffffa02c7ac0 R13: 0000000000000000 R14: ffff88811afa3cd8 R15: ffff88810772fa00 FS: 00007f47b9080740(0000) GS:ffff88852cd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000800000000 CR3: 000000010761e003 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_free_odp_mr+0x95/0xc0 [mlx5_ib] mlx5_ib_dereg_mr+0x128/0x3b0 [mlx5_ib] ib_dereg_mr_user+0x45/0xb0 [ib_core] ? xas_load+0x8/0x80 destroy_hw_idr_uobject+0x1a/0x50 [ib_uverbs] uverbs_destroy_uobject+0x2f/0x150 [ib_uverbs] uobj_destroy+0x3c/0x70 [ib_uverbs] ib_uverbs_cmd_verbs+0x467/0xb00 [ib_uverbs] ? uverbs_finalize_object+0x60/0x60 [ib_uverbs] ? ttwu_queue_wakelist+0xa9/0xe0 ? pty_write+0x85/0x90 ? file_tty_write.isra.33+0x214/0x330 ? process_echoes+0x60/0x60 ib_uverbs_ioctl+0xa7/0x110 [ib_uverbs] __x64_sys_ioctl+0x10d/0x8e0 ? vfs_write+0x17f/0x260 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae
Add the missing xarray initialization and remove the desc_size set.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 22, 2024 |
| Suse | — | Upgrade dtb-mediatekUpgrade kselftests-kmp-defaultUpgrade kernel-macrosUpgrade kernel-rt_debugUpgrade ocfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-zfcpdumpUpgrade dtb-marvellUpgrade kernel-64kb-develUpgrade kernel-rt_debug-vdsoUpgrade dtb-amlogicUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-extraUpgrade dtb-freescaleUpgrade cluster-md-kmp-azureUpgrade dtb-hisiliconUpgrade kernel-devel-rtUpgrade dtb-qcomUpgrade kernel-kvmsmall-develUpgrade kernel-rtUpgrade kernel-syms-azureUpgrade dtb-apmUpgrade kernel-azure-extraUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmallUpgrade kselftests-kmp-64kbUpgrade gfs2-kmp-rtUpgrade dlm-kmp-azureUpgrade kernel-obs-qaUpgrade dlm-kmp-defaultUpgrade dtb-lgUpgrade kernel-syms-rtUpgrade kernel-azure-develUpgrade kernel-debug-livepatch-develUpgrade kernel-64kb-optionalUpgrade kernel-rt-develUpgrade kernel-64kbUpgrade kernel-symsUpgrade cluster-md-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade kernel-docsUpgrade kernel-azure-livepatch-develUpgrade dtb-socionextUpgrade dtb-armUpgrade kernel-default-develUpgrade dtb-exynosUpgrade kernel-source-azureUpgrade kernel-devel-azureUpgrade dtb-amazonUpgrade reiserfs-kmp-azureUpgrade kernel-sourceUpgrade dtb-alteraUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-64kbUpgrade dtb-appleUpgrade reiserfs-kmp-defaultUpgrade kernel-default-optionalUpgrade kselftests-kmp-rtUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-optionalUpgrade dtb-xilinxUpgrade gfs2-kmp-azureUpgrade dtb-rockchipUpgrade dlm-kmp-rtUpgrade kernel-rt-livepatchUpgrade dtb-amdUpgrade kernel-default-livepatch-develUpgrade dtb-nvidiaUpgrade kernel-develUpgrade ocfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-64kb-extraUpgrade kernel-default-vdsoUpgrade kernel-debug-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt_debug-develUpgrade kernel-debugUpgrade reiserfs-kmp-rtUpgrade dtb-caviumUpgrade kernel-rt-vdsoUpgrade kernel-default-baseUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-defaultUpgrade dtb-renesasUpgrade dtb-sprdUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-default-livepatchUpgrade kernel-source-rtUpgrade dtb-allwinnerUpgrade kernel-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azureUpgrade ocfs2-kmp-azureUpgrade dtb-broadcom | Aug 9, 2024 | May 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub