CVE-2021-47078
published 2024-03-01CVE-2021-47078: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Clear all QP fields if creation failed rxe_qp_do_cleanup() relies on valid…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.28%
20.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Clear all QP fields if creation failed
rxe_qp_do_cleanup() relies on valid pointer values in QP for the properly
created ones, but in case rxe_qp_from_init() failed it was filled with
garbage and caused tot the following error.
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 12560 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Modules linked in:
CPU: 1 PID: 12560 Comm: syz-executor.4 Not tainted 5.12.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Code: e9 db fe ff ff 48 89 df e8 2c c2 ea fd e9 8a fe ff ff e8 72 6a a7 fd 48 c7 c7 e0 b2 c1 89 c6 05 dc 3a e6 09 01 e8 ee 74 fb 04 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55
RSP: 0018:ffffc900097ceba8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000040000 RSI: ffffffff815bb075 RDI: fffff520012f9d67
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815b4eae R11: 0000000000000000 R12: ffff8880322a4800
R13: ffff8880322a4940 R14: ffff888033044e00 R15: 0000000000000000
FS: 00007f6eb2be3700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdbe5d41000 CR3: 000000001d181000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__refcount_sub_and_test include/linux/refcount.h:283 [inline]
__refcount_dec_and_test include/linux/refcount.h:315 [inline]
refcount_dec_and_test include/linux/refcount.h:333 [inline]
kref_put include/linux/kref.h:64 [inline]
rxe_qp_do_cleanup+0x96f/0xaf0 drivers/infiniband/sw/rxe/rxe_qp.c:805
execute_in_process_context+0x37/0x150 kernel/workqueue.c:3327
rxe_elem_release+0x9f/0x180 drivers/infiniband/
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.40-1 (bookworm) | linux 5.10.40-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < c65391dd9f0a47617e96e38bd27e277cbe1c40b0 | c65391dd9f0a47617e96e38bd27e277cbe1c40b0 |
| linux | linux | >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < 6a8086a42dfbf548a42bf2ae4faa291645c72c66 | 6a8086a42dfbf548a42bf2ae4faa291645c72c66 |
| linux | linux | >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < f3783c415bf6d2ead3d7aa2c38802bbe10723646 | f3783c415bf6d2ead3d7aa2c38802bbe10723646 |
| linux | linux | >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < a62225d951d77eb20208fed8fc199e0c9b1df08b | a62225d951d77eb20208fed8fc199e0c9b1df08b |
| linux | linux | >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < 2ee4d79c364914989c80de382c0b1a7259a7e4b3 | 2ee4d79c364914989c80de382c0b1a7259a7e4b3 |
| linux | linux | >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < 03344e843ab6dd3b3f2cadfb65ed910590856c70 | 03344e843ab6dd3b3f2cadfb65ed910590856c70 |
| linux | linux | >= 8700e3e7c4857d28ebaa824509934556da0b3e76 < 67f29896fdc83298eed5a6576ff8f9873f709228 | 67f29896fdc83298eed5a6576ff8f9873f709228 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.40-1 | 5.10.40-1 |
| linux | linux_kernel | >= 0 < 5.10.40-1 | 5.10.40-1 |
| linux | linux_kernel | >= 0 < 5.10.40-1 | 5.10.40-1 |
| linux | linux_kernel | >= 0 < 5.10.40-1 | 5.10.40-1 |
| linux | linux_kernel | >= 4.10 < 4.14.234 | 4.14.234 |
| linux | linux_kernel | >= 4.15 < 4.19.192 | 4.19.192 |
| linux | linux_kernel | >= 4.20 < 5.4.122 | 5.4.122 |
| linux | linux_kernel | >= 4.8 < 4.9.270 | 4.9.270 |
| linux | linux_kernel | >= 5.11 < 5.12.7 | 5.12.7 |
| linux | linux_kernel | >= 5.5 < 5.10.40 | 5.10.40 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: RDMA/rxe: Clear all QP fields if creation failed
vendor_redhat·2024-03-01·CVSS 5.3
CVE-2021-47078 [MEDIUM] CWE-416 kernel: RDMA/rxe: Clear all QP fields if creation failed
kernel: RDMA/rxe: Clear all QP fields if creation failed
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Clear all QP fields if creation failed
rxe_qp_do_cleanup() relies on valid pointer values in QP for the properly
created ones, but in case rxe_qp_from_init() failed it was filled with
garbage and caused tot the following error.
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 12560 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Modules linked in:
CPU: 1 PID: 12560 Comm: syz-executor.4 Not tainted 5.12.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Code: e9 db fe ff ff 48 89 df e8 2c c2 ea fd e9 8a fe
Debian
CVE-2021-47078: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: C...
vendor_debian·2021·CVSS 5.3
CVE-2021-47078 [MEDIUM] CVE-2021-47078: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: C...
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Clear all QP fields if creation failed rxe_qp_do_cleanup() relies on valid pointer values in QP for the properly created ones, but in case rxe_qp_from_init() failed it was filled with garbage and caused tot the following error. refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 12560 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28 Modules linked in: CPU: 1 PID: 12560 Comm: syz-executor.4 Not tainted 5.12.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28 Code: e9 db fe ff ff 48 89 df e8 2c c2 ea fd e9 8a fe ff ff e8 72 6a a7 fd 48 c7 c7 e0 b2 c1 89 c6 05 dc 3a e6
GHSA
GHSA-c56c-8vvg-gr68: In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Clear all QP fields if creation failed
rxe_qp_do_cleanup() relies on v
ghsa_unreviewed·2024-03-02
CVE-2021-47078 [MEDIUM] CWE-416 GHSA-c56c-8vvg-gr68: In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Clear all QP fields if creation failed
rxe_qp_do_cleanup() relies on v
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Clear all QP fields if creation failed
rxe_qp_do_cleanup() relies on valid pointer values in QP for the properly
created ones, but in case rxe_qp_from_init() failed it was filled with
garbage and caused tot the following error.
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 12560 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Modules linked in:
CPU: 1 PID: 12560 Comm: syz-executor.4 Not tainted 5.12.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Code: e9 db fe ff ff 48 89 df e8 2c c2 ea fd e9 8a fe ff ff e8 72 6a a7 fd 48 c7 c7 e0 b2 c1 89 c6 05 dc 3a
OSV
CVE-2021-47078: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Clear all QP fields if creation failed rxe_qp_do_cleanup() relies on val
osv·2024-03-01·CVSS 5.3
CVE-2021-47078 [MEDIUM] CVE-2021-47078: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Clear all QP fields if creation failed rxe_qp_do_cleanup() relies on val
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Clear all QP fields if creation failed rxe_qp_do_cleanup() relies on valid pointer values in QP for the properly created ones, but in case rxe_qp_from_init() failed it was filled with garbage and caused tot the following error. refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 12560 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28 Modules linked in: CPU: 1 PID: 12560 Comm: syz-executor.4 Not tainted 5.12.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28 Code: e9 db fe ff ff 48 89 df e8 2c c2 ea fd e9 8a fe ff ff e8 72 6a a7 fd 48 c7 c7 e0 b2 c1 89 c6 05 dc 3a e6
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/03344e843ab6dd3b3f2cadfb65ed910590856c70https://git.kernel.org/stable/c/2ee4d79c364914989c80de382c0b1a7259a7e4b3https://git.kernel.org/stable/c/67f29896fdc83298eed5a6576ff8f9873f709228https://git.kernel.org/stable/c/6a8086a42dfbf548a42bf2ae4faa291645c72c66https://git.kernel.org/stable/c/a62225d951d77eb20208fed8fc199e0c9b1df08bhttps://git.kernel.org/stable/c/c65391dd9f0a47617e96e38bd27e277cbe1c40b0https://git.kernel.org/stable/c/f3783c415bf6d2ead3d7aa2c38802bbe10723646https://git.kernel.org/stable/c/03344e843ab6dd3b3f2cadfb65ed910590856c70https://git.kernel.org/stable/c/2ee4d79c364914989c80de382c0b1a7259a7e4b3https://git.kernel.org/stable/c/67f29896fdc83298eed5a6576ff8f9873f709228https://git.kernel.org/stable/c/6a8086a42dfbf548a42bf2ae4faa291645c72c66https://git.kernel.org/stable/c/a62225d951d77eb20208fed8fc199e0c9b1df08bhttps://git.kernel.org/stable/c/c65391dd9f0a47617e96e38bd27e277cbe1c40b0https://git.kernel.org/stable/c/f3783c415bf6d2ead3d7aa2c38802bbe10723646
2024-03-01
Published