Riskcovery

CVE-2021-47012

RDMA/siw: Fix a use after free in siw_alloc_mr

State
Published
Severity
7.8 High
Published
Feb 28, 2024
Updated
Aug 5, 2026
Reserved
Feb 27, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix a use after free in siw_alloc_mr

Our code analyzer reported a UAF.

In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a freed object. After, the execution continue up to the err_out branch of siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr).

My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {} section, to avoid the uaf.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 2251334dcac9eb337575d8767e2a6a7e81848f7f to before 30b9e92d0b5e5d5dc1101ab856c17009537cbca4Affected
  • 2251334dcac9eb337575d8767e2a6a7e81848f7f to before 608a4b90ece039940e9425ee2b39c8beff27e00cAffected
  • 2251334dcac9eb337575d8767e2a6a7e81848f7f to before 3e22b88e02c194f6c80867abfef5cc09383461f4Affected
  • 2251334dcac9eb337575d8767e2a6a7e81848f7f to before ad9ce7188432650469a6c7625bf479f5ed0b6155Affected
  • 2251334dcac9eb337575d8767e2a6a7e81848f7f to before 3093ee182f01689b89e9f8797b321603e5de4f63Affected
LinuxLinux
  • 5.3Affected
  • before 5.3Not affected
  • 5.4.119 through 5.4.*Not affected
  • 5.10.37 through 5.10.*Not affected
  • 5.11.21 through 5.11.*Not affected
  • 5.12.4 through 5.12.*Not affected
  • 5.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.