Log in Start free

Vulnerability · Published Nov 7, 2024 · Assigned by Linux

CVE-2024-50147net/mlx5: Fix command bitmask initialization

Medium 5.5

In plain English

A medium-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 86.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix command bitmask initialization Command bitmask have a dedicated bit for MANAGE_PAGES command, this bit isn't Initialize during command bitmask Initialization, only during MANAGE_PAGES. In addition, mlx5_cmd_trigger_completions() is trying to trigger completion for MANAGE_PAGES command as well. Hence, in case health error occurred before any MANAGE_PAGES command have been invoke (for example, during mlx5_enable_hca()), mlx5_cmd_trigger_completions() will try to trigger completion for MANAGE_PAGES command, which will result in null-ptr-deref error.[1] Fix it by Initialize command bitmask correctly. While at it, re-write the code for better understanding. [1] BUG: KASAN: null-ptr-deref in mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core] Write of size 4 at addr 0000000000000214 by task kworker/u96:2/12078 CPU: 10 PID: 12078 Comm: kworker/u96:2 Not tainted 6.9.0-rc2_for_upstream_debug_2024_04_07_19_01 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_health0000:08:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core] Call Trace: <TASK> dump_stack_lvl+0x7e/0xc0 kasan_report+0xb9/0xf0 kasan_check_range+0xec/0x190 mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core] mlx5_cmd_flush+0x94/0x240 [mlx5_core] enter_error_state+0x6c/0xd0 [mlx5_core] mlx5_fw_fatal_reporter_err_work+0xf3/0x480 [mlx5_core] process_one_work+0x787/0x1490 ? lockdep_hardirqs_on_prepare+0x400/0x400 ? pwq_dec_nr_in_flight+0xda0/0xda0 ? assign_work+0x168/0x240 worker_thread+0x586/0xd30 ? rescuer_thread+0xae0/0xae0 kthread+0x2df/0x3b0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x2d/0x70 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork_asm+0x11/0x20 </TASK>

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.115-1DEBIAN-CVE-2024-50147
Debian:13linux6.11.6-1DEBIAN-CVE-2024-50147
Debian:14linux6.11.6-1DEBIAN-CVE-2024-50147
Ubuntu:24.04:LTSlinux6.8.0-58.60UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-aws6.8.0-1027.29UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1027.29~22.04.1UBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-azure6.8.0-1027.32UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-azure-6.116.11.0-1012.12~24.04.1UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1027.32~22.04.1UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-azure-nvidia6.8.0-1014.15UBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-gcp6.8.0-1028.30UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-gcp-6.116.11.0-1011.11~24.04.1UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1028.30~22.04.1UBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-gke6.8.0-1023.27UBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1010.12UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-58.60~22.04.1UBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-ibm6.8.0-1024.24UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1024.24~22.04.1UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-58.60.1UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-58.60.1~22.04.1UBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1026.29UBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-nvidia-6.116.11.0-1007.7UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1026.29~22.04.1UBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1026.29.1UBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1008.8UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1015.15UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1026.26UBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-oracle6.8.0-1024.25UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1024.25~22.04.1UBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-raspi6.8.0-1028.32UBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-riscv6.8.0-58.60.1UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-58.60.1~22.04.1UBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-50147
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-50147
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1017.18UBUNTU-CVE-2024-50147

Affected products (as reported)

VendorProductVersions
Linux Linux 9b98d395b85dd042fe83fb696b1ac02e6c93a520 – before d1606090bb294cecb7de3c4ed177f5aa0abd4c4e9b98d395b85dd042fe83fb696b1ac02e6c93a520 – before d88564c79d1cedaf2655f12261eca0d2796bde4e9b98d395b85dd042fe83fb696b1ac02e6c93a520 – before 2feac1e562be0efc621a6722644a90f355d534739b98d395b85dd042fe83fb696b1ac02e6c93a520 – before d62b14045c6511a7b2d4948d1a83a4e592deeb05
Linux Linux 6.1

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References