Log in Start free

Vulnerability · Published Jun 19, 2024 · Assigned by Linux

CVE-2024-38545RDMA/hns: Fix UAF for cq async event

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 83.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix UAF for cq async event The refcount of CQ is not protected by locks. When CQ asynchronous events and CQ destruction are concurrent, CQ may have been released, which will cause UAF. Use the xa_lock() to protect the CQ refcount.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.94-1DEBIAN-CVE-2024-38545
Debian:13linux6.8.12-1DEBIAN-CVE-2024-38545
Debian:14linux6.8.12-1DEBIAN-CVE-2024-38545
Ubuntu:22.04:LTSlinux5.15.0-127.137UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux5.15.0-127.137USN-7166-1
Ubuntu:24.04:LTSlinux6.8.0-40.40UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-aws5.15.0-1073.79UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-aws5.15.0-1073.79USN-7166-2
Ubuntu:24.04:LTSlinux-aws6.8.0-1013.14UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1013.14~22.04.1UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-azure5.15.0-1078.87UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-azure5.15.0-1078.87USN-7186-2
Ubuntu:24.04:LTSlinux-azure6.8.0-1012.14UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1012.14~22.04.1UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1078.87.1UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-gcp5.15.0-1072.80UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-gcp5.15.0-1072.80USN-7166-1
Ubuntu:24.04:LTSlinux-gcp6.8.0-1012.13UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1012.13~22.04.1UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-gke5.15.0-1070.76UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-gke5.15.0-1070.76USN-7166-1
Ubuntu:24.04:LTSlinux-gke6.8.0-1008.11UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1056.63UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1056.63USN-7166-1
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-40.40~22.04.3UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-ibm5.15.0-1066.69UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-ibm5.15.0-1066.69USN-7166-1
Ubuntu:24.04:LTSlinux-ibm6.8.0-1010.10UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1010.10~22.04.1UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1071.77UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1071.77USN-7186-1
Ubuntu:22.04:LTSlinux-kvm5.15.0-1070.75UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-kvm5.15.0-1070.75USN-7166-1
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-127.137UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-127.137USN-7166-1
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-40.40.1UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-40.40.1~22.04.1UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1068.69UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1068.69USN-7166-1
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1011.11UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1011.11~22.04.1UBUNTU-CVE-2024-38545
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1011.11.1UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1032.32UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1020.20UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-38545
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1010.10UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-oracle5.15.0-1071.77UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-oracle5.15.0-1071.77USN-7166-1
Ubuntu:24.04:LTSlinux-oracle6.8.0-1010.10UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1010.10~22.04.1UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-raspi5.15.0-1066.69USN-7166-1
Ubuntu:22.04:LTSlinux-raspi5.15.0-1066.69UBUNTU-CVE-2024-38545
Ubuntu:24.04:LTSlinux-raspi6.8.0-1009.10UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-38545
Ubuntu:24.04:LTSlinux-riscv6.8.0-40.40.1UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-40.40.1~22.04.1UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1039.43UBUNTU-CVE-2024-38545
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1039.43USN-7166-4

Affected products (as reported)

VendorProductVersions
Linux Linux 9a4435375cd151e07c0c38fa601b00115986091b – before 330c825e66ef65278e4ebe57fd49c1d6f3f4e34e9a4435375cd151e07c0c38fa601b00115986091b – before 763780ef0336a973e933e40e919339381732dcaf9a4435375cd151e07c0c38fa601b00115986091b – before 63da190eeb5c9d849b71f457b15b308c94cbaf089a4435375cd151e07c0c38fa601b00115986091b – before 39d26cf46306bdc7ae809ecfdbfeff5aa10989119a4435375cd151e07c0c38fa601b00115986091b – before 37a7559dc1358a8d300437e99ed8ecdab06715079a4435375cd151e07c0c38fa601b00115986091b – before a942ec2745ca864cd8512142100e4027dc306a42
Linux Linux 4.9

References