CVE-2021-47391 (GCVE-0-2021-47391)
Vulnerability from cvelistv5
Published
2024-05-21 15:03
Modified
2026-08-05 08:47
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests The FSM can run in a circle allowing rdma_resolve_ip() to be called twice on the same id_priv. While this cannot happen without going through the work, it violates the invariant that the same address resolution background request cannot be active twice. CPU 1 CPU 2 rdma_resolve_addr(): RDMA_CM_IDLE -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) #1 process_one_req(): for #1 addr_handler(): RDMA_CM_ADDR_QUERY -> RDMA_CM_ADDR_BOUND mutex_unlock(&id_priv->handler_mutex); [.. handler still running ..] rdma_resolve_addr(): RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) !! two requests are now on the req_list rdma_destroy_id(): destroy_id_handler_unlock(): _destroy_id(): cma_cancel_operation(): rdma_addr_cancel() // process_one_req() self removes it spin_lock_bh(&lock); cancel_delayed_work(&req->work); if (!list_empty(&req->list)) == true ! rdma_addr_cancel() returns after process_on_req #1 is done kfree(id_priv) process_one_req(): for #2 addr_handler(): mutex_lock(&id_priv->handler_mutex); !! Use after free on id_priv rdma_addr_cancel() expects there to be one req on the list and only cancels the first one. The self-removal behavior of the work only happens after the handler has returned. This yields a situations where the req_list can have two reqs for the same "handle" but rdma_addr_cancel() only cancels the first one. The second req remains active beyond rdma_destroy_id() and will use-after-free id_priv once it inevitably triggers. Fix this by remembering if the id_priv has called rdma_resolve_ip() and always cancel before calling it again. This ensures the req_list never gets more than one item in it and doesn't cost anything in the normal flow that never uses this strange error path.
References
Impacted products
Vendor Product Version
Linux Linux Version: e51060f08a61965c4dd91516d82fe90617152590
Version: e51060f08a61965c4dd91516d82fe90617152590
Version: e51060f08a61965c4dd91516d82fe90617152590
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47391",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T17:33:43.729564Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:30.710Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.044Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9a085fa9b7d644a234465091e038c1911e1a4f2a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/03d884671572af8bcfbc9e63944c1021efce7589"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/305d568b72f17f674155a2a8275f865f207b3808"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/cma.c",
            "drivers/infiniband/core/cma_priv.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a085fa9b7d644a234465091e038c1911e1a4f2a",
              "status": "affected",
              "version": "e51060f08a61965c4dd91516d82fe90617152590",
              "versionType": "git"
            },
            {
              "lessThan": "03d884671572af8bcfbc9e63944c1021efce7589",
              "status": "affected",
              "version": "e51060f08a61965c4dd91516d82fe90617152590",
              "versionType": "git"
            },
            {
              "lessThan": "305d568b72f17f674155a2a8275f865f207b3808",
              "status": "affected",
              "version": "e51060f08a61965c4dd91516d82fe90617152590",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/cma.c",
            "drivers/infiniband/core/cma_priv.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.18"
            },
            {
              "lessThan": "2.6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.188",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.10",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests\n\nThe FSM can run in a circle allowing rdma_resolve_ip() to be called twice\non the same id_priv. While this cannot happen without going through the\nwork, it violates the invariant that the same address resolution\nbackground request cannot be active twice.\n\n       CPU 1                                  CPU 2\n\nrdma_resolve_addr():\n  RDMA_CM_IDLE -\u003e RDMA_CM_ADDR_QUERY\n  rdma_resolve_ip(addr_handler)  #1\n\n\t\t\t process_one_req(): for #1\n                          addr_handler():\n                            RDMA_CM_ADDR_QUERY -\u003e RDMA_CM_ADDR_BOUND\n                            mutex_unlock(\u0026id_priv-\u003ehandler_mutex);\n                            [.. handler still running ..]\n\nrdma_resolve_addr():\n  RDMA_CM_ADDR_BOUND -\u003e RDMA_CM_ADDR_QUERY\n  rdma_resolve_ip(addr_handler)\n    !! two requests are now on the req_list\n\nrdma_destroy_id():\n destroy_id_handler_unlock():\n  _destroy_id():\n   cma_cancel_operation():\n    rdma_addr_cancel()\n\n                          // process_one_req() self removes it\n\t\t          spin_lock_bh(\u0026lock);\n                           cancel_delayed_work(\u0026req-\u003ework);\n\t                   if (!list_empty(\u0026req-\u003elist)) == true\n\n      ! rdma_addr_cancel() returns after process_on_req #1 is done\n\n   kfree(id_priv)\n\n\t\t\t process_one_req(): for #2\n                          addr_handler():\n\t                    mutex_lock(\u0026id_priv-\u003ehandler_mutex);\n                            !! Use after free on id_priv\n\nrdma_addr_cancel() expects there to be one req on the list and only\ncancels the first one. The self-removal behavior of the work only happens\nafter the handler has returned. This yields a situations where the\nreq_list can have two reqs for the same \"handle\" but rdma_addr_cancel()\nonly cancels the first one.\n\nThe second req remains active beyond rdma_destroy_id() and will\nuse-after-free id_priv once it inevitably triggers.\n\nFix this by remembering if the id_priv has called rdma_resolve_ip() and\nalways cancel before calling it again. This ensures the req_list never\ngets more than one item in it and doesn\u0027t cost anything in the normal flow\nthat never uses this strange error path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the RDMA userspace CM misc device (/dev/infiniband/rdma_cm) via ucma_resolve_ip/ucma_resolve_addr and destroy ioctls; it is a local syscall path, not triggered by remote packets alone.\nAC:L - The attacker fully controls both sides of the race by issuing concurrent RESOLVE_IP and DESTROY_ID commands on the same CM id, so success does not depend on victim state outside attacker influence.\nPR:L - The rdma_cm misc device is registered with mode 0666 and create/resolve/destroy paths perform no capability checks, so any unprivileged local user can open it and trigger the bug.\nUI:N - Exploitation requires only the attacker\u0027s own ucma operations; no action by another user is needed.\nS:U - This is a standard in-kernel use-after-free leading to privilege escalation within the same OS security authority, not a VM/IOMMU/sandbox boundary crossing.\nC:H - The dangling addr_handler runs against a freed rdma_id_private, giving a classic kernel UAF that can be leveraged for arbitrary memory disclosure.\nI:H - UAF of id_priv enables heap reuse and corruption suitable for arbitrary write or control-flow hijacking in the kernel.\nA:H - The second queued request inevitably invokes addr_handler on freed memory, causing kernel oops/panic even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:47:36.737Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a085fa9b7d644a234465091e038c1911e1a4f2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/03d884671572af8bcfbc9e63944c1021efce7589"
        },
        {
          "url": "https://git.kernel.org/stable/c/305d568b72f17f674155a2a8275f865f207b3808"
        }
      ],
      "title": "RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47391",
    "datePublished": "2024-05-21T15:03:49.545Z",
    "dateReserved": "2024-05-21T14:58:30.813Z",
    "dateUpdated": "2026-08-05T08:47:36.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9a085fa9b7d644a234465091e038c1911e1a4f2a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/03d884671572af8bcfbc9e63944c1021efce7589\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/305d568b72f17f674155a2a8275f865f207b3808\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.044Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47391\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-21T17:33:43.729564Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.320Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached through the RDMA userspace CM misc device (/dev/infiniband/rdma_cm) via ucma_resolve_ip/ucma_resolve_addr and destroy ioctls; it is a local syscall path, not triggered by remote packets alone.\\nAC:L - The attacker fully controls both sides of the race by issuing concurrent RESOLVE_IP and DESTROY_ID commands on the same CM id, so success does not depend on victim state outside attacker influence.\\nPR:L - The rdma_cm misc device is registered with mode 0666 and create/resolve/destroy paths perform no capability checks, so any unprivileged local user can open it and trigger the bug.\\nUI:N - Exploitation requires only the attacker\u0027s own ucma operations; no action by another user is needed.\\nS:U - This is a standard in-kernel use-after-free leading to privilege escalation within the same OS security authority, not a VM/IOMMU/sandbox boundary crossing.\\nC:H - The dangling addr_handler runs against a freed rdma_id_private, giving a classic kernel UAF that can be leveraged for arbitrary memory disclosure.\\nI:H - UAF of id_priv enables heap reuse and corruption suitable for arbitrary write or control-flow hijacking in the kernel.\\nA:H - The second queued request inevitably invokes addr_handler on freed memory, causing kernel oops/panic even when not fully exploited.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e51060f08a61965c4dd91516d82fe90617152590\", \"lessThan\": \"9a085fa9b7d644a234465091e038c1911e1a4f2a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e51060f08a61965c4dd91516d82fe90617152590\", \"lessThan\": \"03d884671572af8bcfbc9e63944c1021efce7589\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e51060f08a61965c4dd91516d82fe90617152590\", \"lessThan\": \"305d568b72f17f674155a2a8275f865f207b3808\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/core/cma.c\", \"drivers/infiniband/core/cma_priv.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.188\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/core/cma.c\", \"drivers/infiniband/core/cma_priv.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9a085fa9b7d644a234465091e038c1911e1a4f2a\"}, {\"url\": \"https://git.kernel.org/stable/c/03d884671572af8bcfbc9e63944c1021efce7589\"}, {\"url\": \"https://git.kernel.org/stable/c/305d568b72f17f674155a2a8275f865f207b3808\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests\\n\\nThe FSM can run in a circle allowing rdma_resolve_ip() to be called twice\\non the same id_priv. While this cannot happen without going through the\\nwork, it violates the invariant that the same address resolution\\nbackground request cannot be active twice.\\n\\n       CPU 1                                  CPU 2\\n\\nrdma_resolve_addr():\\n  RDMA_CM_IDLE -\u003e RDMA_CM_ADDR_QUERY\\n  rdma_resolve_ip(addr_handler)  #1\\n\\n\\t\\t\\t process_one_req(): for #1\\n                          addr_handler():\\n                            RDMA_CM_ADDR_QUERY -\u003e RDMA_CM_ADDR_BOUND\\n                            mutex_unlock(\u0026id_priv-\u003ehandler_mutex);\\n                            [.. handler still running ..]\\n\\nrdma_resolve_addr():\\n  RDMA_CM_ADDR_BOUND -\u003e RDMA_CM_ADDR_QUERY\\n  rdma_resolve_ip(addr_handler)\\n    !! two requests are now on the req_list\\n\\nrdma_destroy_id():\\n destroy_id_handler_unlock():\\n  _destroy_id():\\n   cma_cancel_operation():\\n    rdma_addr_cancel()\\n\\n                          // process_one_req() self removes it\\n\\t\\t          spin_lock_bh(\u0026lock);\\n                           cancel_delayed_work(\u0026req-\u003ework);\\n\\t                   if (!list_empty(\u0026req-\u003elist)) == true\\n\\n      ! rdma_addr_cancel() returns after process_on_req #1 is done\\n\\n   kfree(id_priv)\\n\\n\\t\\t\\t process_one_req(): for #2\\n                          addr_handler():\\n\\t                    mutex_lock(\u0026id_priv-\u003ehandler_mutex);\\n                            !! Use after free on id_priv\\n\\nrdma_addr_cancel() expects there to be one req on the list and only\\ncancels the first one. The self-removal behavior of the work only happens\\nafter the handler has returned. This yields a situations where the\\nreq_list can have two reqs for the same \\\"handle\\\" but rdma_addr_cancel()\\nonly cancels the first one.\\n\\nThe second req remains active beyond rdma_destroy_id() and will\\nuse-after-free id_priv once it inevitably triggers.\\n\\nFix this by remembering if the id_priv has called rdma_resolve_ip() and\\nalways cancel before calling it again. This ensures the req_list never\\ngets more than one item in it and doesn\u0027t cost anything in the normal flow\\nthat never uses this strange error path.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.188\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14.10\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15\", \"versionStartIncluding\": \"2.6.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:47:36.737Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47391\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:47:36.737Z\", \"dateReserved\": \"2024-05-21T14:58:30.813Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:03:49.545Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.