Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-47378
HistoryMay 21, 2024 - 12:00 a.m.

CVE-2021-47378

2024-05-2100:00:00
ubuntu.com
ubuntu.com
6
linux kernel
nvme-rdma
vulnerability
error flow
rdma
connection establishment

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

0

Percentile

15.5%

In the Linux kernel, the following vulnerability has been resolved:
nvme-rdma: destroy cm id before destroy qp to avoid use after free We
should always destroy cm_id before destroy qp to avoid to get cma event
after qp was destroyed, which may lead to use after free. In RDMA
connection establishment error flow, don’t destroy qp in cm event
handler.Just report cm_error to upper level, qp will be destroy in
nvme_rdma_alloc_queue() after destroy cm id.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

0

Percentile

15.5%