Lucene search

K
debiancveDebian Security Bug TrackerDEBIANCVE:CVE-2021-47378
HistoryMay 21, 2024 - 3:15 p.m.

CVE-2021-47378

2024-05-2115:15:23
Debian Security Bug Tracker
security-tracker.debian.org
12
linux
kernel
vulnerability
resolved
nvme-rdma
destroy
cm id
qp
use after free
rdma
connection
establishment
error
flow
cma event
handler
cm_error
upper level
nvme_rdma_alloc_queue
unix

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7

Confidence

Low

EPSS

0

Percentile

15.5%

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: destroy cm id before destroy qp to avoid use after free We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use after free. In RDMA connection establishment error flow, don’t destroy qp in cm event handler.Just report cm_error to upper level, qp will be destroy in nvme_rdma_alloc_queue() after destroy cm id.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7

Confidence

Low

EPSS

0

Percentile

15.5%