Log in Start free

Vulnerability · Published Jun 19, 2024 · Assigned by Linux

CVE-2021-47616RDMA: Fix use-after-free in rxe_queue_cleanup

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 87.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: RDMA: Fix use-after-free in rxe_queue_cleanup On error handling path in rxe_qp_from_init() qp->sq.queue is freed and then rxe_create_qp() will drop last reference to this object. qp clean up function will try to free this queue one time and it causes UAF bug. Fix it by zeroing queue pointer after freeing queue in rxe_qp_from_init().

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.15.15-1DEBIAN-CVE-2021-47616
Debian:13linux5.15.15-1DEBIAN-CVE-2021-47616
Debian:14linux5.15.15-1DEBIAN-CVE-2021-47616
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-47616
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-47616

Affected products (as reported)

VendorProductVersions
Linux Linux 514aee660df493cd673154a6ba6bab745ec47b8c – before acb53e47db1fbc7cd37ab10b46388f045a76e383514aee660df493cd673154a6ba6bab745ec47b8c – before 84b01721e8042cdd1e8ffeb648844a09cd4213e0
Linux Linux 5.15

References