cbcvebase.
CVE-2021-47012
published 2024-02-28

CVE-2021-47012: In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix a use after free in siw_alloc_mr Our code analyzer reported a UAF. In…

PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.27%
18.9th percentile
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix a use after free in siw_alloc_mr Our code analyzer reported a UAF. In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a freed object. After, the execution continue up to the err_out branch of siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr). My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {} section, to avoid the uaf.

Affected

15 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.10.38-1 (bookworm)linux 5.10.38-1 (bookworm)
linuxlinux——
linuxlinux>= 2251334dcac9eb337575d8767e2a6a7e81848f7f < 30b9e92d0b5e5d5dc1101ab856c17009537cbca430b9e92d0b5e5d5dc1101ab856c17009537cbca4
linuxlinux>= 2251334dcac9eb337575d8767e2a6a7e81848f7f < 608a4b90ece039940e9425ee2b39c8beff27e00c608a4b90ece039940e9425ee2b39c8beff27e00c
linuxlinux>= 2251334dcac9eb337575d8767e2a6a7e81848f7f < 3e22b88e02c194f6c80867abfef5cc09383461f43e22b88e02c194f6c80867abfef5cc09383461f4
linuxlinux>= 2251334dcac9eb337575d8767e2a6a7e81848f7f < ad9ce7188432650469a6c7625bf479f5ed0b6155ad9ce7188432650469a6c7625bf479f5ed0b6155
linuxlinux>= 2251334dcac9eb337575d8767e2a6a7e81848f7f < 3093ee182f01689b89e9f8797b321603e5de4f633093ee182f01689b89e9f8797b321603e5de4f63
linuxlinux_kernel>= 0 < 5.10.38-15.10.38-1
linuxlinux_kernel>= 0 < 5.10.38-15.10.38-1
linuxlinux_kernel>= 0 < 5.10.38-15.10.38-1
linuxlinux_kernel>= 0 < 5.10.38-15.10.38-1
linuxlinux_kernel>= 5.11 < 5.11.215.11.21
linuxlinux_kernel>= 5.12 < 5.12.45.12.4
linuxlinux_kernel>= 5.3 < 5.4.1195.4.119
linuxlinux_kernel>= 5.5 < 5.10.375.10.37

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.