CVE-2021-47391 (GCVE-0-2021-47391)
Vulnerability from cvelistv5
Published
2024-05-21 15:03
Modified
2025-05-04 07:10
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests The FSM can run in a circle allowing rdma_resolve_ip() to be called twice on the same id_priv. While this cannot happen without going through the work, it violates the invariant that the same address resolution background request cannot be active twice. CPU 1 CPU 2 rdma_resolve_addr(): RDMA_CM_IDLE -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) #1 process_one_req(): for #1 addr_handler(): RDMA_CM_ADDR_QUERY -> RDMA_CM_ADDR_BOUND mutex_unlock(&id_priv->handler_mutex); [.. handler still running ..] rdma_resolve_addr(): RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) !! two requests are now on the req_list rdma_destroy_id(): destroy_id_handler_unlock(): _destroy_id(): cma_cancel_operation(): rdma_addr_cancel() // process_one_req() self removes it spin_lock_bh(&lock); cancel_delayed_work(&req->work); if (!list_empty(&req->list)) == true ! rdma_addr_cancel() returns after process_on_req #1 is done kfree(id_priv) process_one_req(): for #2 addr_handler(): mutex_lock(&id_priv->handler_mutex); !! Use after free on id_priv rdma_addr_cancel() expects there to be one req on the list and only cancels the first one. The self-removal behavior of the work only happens after the handler has returned. This yields a situations where the req_list can have two reqs for the same "handle" but rdma_addr_cancel() only cancels the first one. The second req remains active beyond rdma_destroy_id() and will use-after-free id_priv once it inevitably triggers. Fix this by remembering if the id_priv has called rdma_resolve_ip() and always cancel before calling it again. This ensures the req_list never gets more than one item in it and doesn't cost anything in the normal flow that never uses this strange error path.
References
Impacted products
Vendor Product Version
Linux Linux Version: e51060f08a61965c4dd91516d82fe90617152590
Version: e51060f08a61965c4dd91516d82fe90617152590
Version: e51060f08a61965c4dd91516d82fe90617152590
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47391",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T17:33:43.729564Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:30.710Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.044Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9a085fa9b7d644a234465091e038c1911e1a4f2a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/03d884671572af8bcfbc9e63944c1021efce7589"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/305d568b72f17f674155a2a8275f865f207b3808"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/cma.c",
            "drivers/infiniband/core/cma_priv.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a085fa9b7d644a234465091e038c1911e1a4f2a",
              "status": "affected",
              "version": "e51060f08a61965c4dd91516d82fe90617152590",
              "versionType": "git"
            },
            {
              "lessThan": "03d884671572af8bcfbc9e63944c1021efce7589",
              "status": "affected",
              "version": "e51060f08a61965c4dd91516d82fe90617152590",
              "versionType": "git"
            },
            {
              "lessThan": "305d568b72f17f674155a2a8275f865f207b3808",
              "status": "affected",
              "version": "e51060f08a61965c4dd91516d82fe90617152590",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/cma.c",
            "drivers/infiniband/core/cma_priv.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.18"
            },
            {
              "lessThan": "2.6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.188",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.10",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests\n\nThe FSM can run in a circle allowing rdma_resolve_ip() to be called twice\non the same id_priv. While this cannot happen without going through the\nwork, it violates the invariant that the same address resolution\nbackground request cannot be active twice.\n\n       CPU 1                                  CPU 2\n\nrdma_resolve_addr():\n  RDMA_CM_IDLE -\u003e RDMA_CM_ADDR_QUERY\n  rdma_resolve_ip(addr_handler)  #1\n\n\t\t\t process_one_req(): for #1\n                          addr_handler():\n                            RDMA_CM_ADDR_QUERY -\u003e RDMA_CM_ADDR_BOUND\n                            mutex_unlock(\u0026id_priv-\u003ehandler_mutex);\n                            [.. handler still running ..]\n\nrdma_resolve_addr():\n  RDMA_CM_ADDR_BOUND -\u003e RDMA_CM_ADDR_QUERY\n  rdma_resolve_ip(addr_handler)\n    !! two requests are now on the req_list\n\nrdma_destroy_id():\n destroy_id_handler_unlock():\n  _destroy_id():\n   cma_cancel_operation():\n    rdma_addr_cancel()\n\n                          // process_one_req() self removes it\n\t\t          spin_lock_bh(\u0026lock);\n                           cancel_delayed_work(\u0026req-\u003ework);\n\t                   if (!list_empty(\u0026req-\u003elist)) == true\n\n      ! rdma_addr_cancel() returns after process_on_req #1 is done\n\n   kfree(id_priv)\n\n\t\t\t process_one_req(): for #2\n                          addr_handler():\n\t                    mutex_lock(\u0026id_priv-\u003ehandler_mutex);\n                            !! Use after free on id_priv\n\nrdma_addr_cancel() expects there to be one req on the list and only\ncancels the first one. The self-removal behavior of the work only happens\nafter the handler has returned. This yields a situations where the\nreq_list can have two reqs for the same \"handle\" but rdma_addr_cancel()\nonly cancels the first one.\n\nThe second req remains active beyond rdma_destroy_id() and will\nuse-after-free id_priv once it inevitably triggers.\n\nFix this by remembering if the id_priv has called rdma_resolve_ip() and\nalways cancel before calling it again. This ensures the req_list never\ngets more than one item in it and doesn\u0027t cost anything in the normal flow\nthat never uses this strange error path."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:10:00.803Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a085fa9b7d644a234465091e038c1911e1a4f2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/03d884671572af8bcfbc9e63944c1021efce7589"
        },
        {
          "url": "https://git.kernel.org/stable/c/305d568b72f17f674155a2a8275f865f207b3808"
        }
      ],
      "title": "RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47391",
    "datePublished": "2024-05-21T15:03:49.545Z",
    "dateReserved": "2024-05-21T14:58:30.813Z",
    "dateUpdated": "2025-05-04T07:10:00.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9a085fa9b7d644a234465091e038c1911e1a4f2a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/03d884671572af8bcfbc9e63944c1021efce7589\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/305d568b72f17f674155a2a8275f865f207b3808\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.044Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47391\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-21T17:33:43.729564Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.320Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e51060f08a61965c4dd91516d82fe90617152590\", \"lessThan\": \"9a085fa9b7d644a234465091e038c1911e1a4f2a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e51060f08a61965c4dd91516d82fe90617152590\", \"lessThan\": \"03d884671572af8bcfbc9e63944c1021efce7589\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e51060f08a61965c4dd91516d82fe90617152590\", \"lessThan\": \"305d568b72f17f674155a2a8275f865f207b3808\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/core/cma.c\", \"drivers/infiniband/core/cma_priv.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.188\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/core/cma.c\", \"drivers/infiniband/core/cma_priv.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9a085fa9b7d644a234465091e038c1911e1a4f2a\"}, {\"url\": \"https://git.kernel.org/stable/c/03d884671572af8bcfbc9e63944c1021efce7589\"}, {\"url\": \"https://git.kernel.org/stable/c/305d568b72f17f674155a2a8275f865f207b3808\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests\\n\\nThe FSM can run in a circle allowing rdma_resolve_ip() to be called twice\\non the same id_priv. While this cannot happen without going through the\\nwork, it violates the invariant that the same address resolution\\nbackground request cannot be active twice.\\n\\n       CPU 1                                  CPU 2\\n\\nrdma_resolve_addr():\\n  RDMA_CM_IDLE -\u003e RDMA_CM_ADDR_QUERY\\n  rdma_resolve_ip(addr_handler)  #1\\n\\n\\t\\t\\t process_one_req(): for #1\\n                          addr_handler():\\n                            RDMA_CM_ADDR_QUERY -\u003e RDMA_CM_ADDR_BOUND\\n                            mutex_unlock(\u0026id_priv-\u003ehandler_mutex);\\n                            [.. handler still running ..]\\n\\nrdma_resolve_addr():\\n  RDMA_CM_ADDR_BOUND -\u003e RDMA_CM_ADDR_QUERY\\n  rdma_resolve_ip(addr_handler)\\n    !! two requests are now on the req_list\\n\\nrdma_destroy_id():\\n destroy_id_handler_unlock():\\n  _destroy_id():\\n   cma_cancel_operation():\\n    rdma_addr_cancel()\\n\\n                          // process_one_req() self removes it\\n\\t\\t          spin_lock_bh(\u0026lock);\\n                           cancel_delayed_work(\u0026req-\u003ework);\\n\\t                   if (!list_empty(\u0026req-\u003elist)) == true\\n\\n      ! rdma_addr_cancel() returns after process_on_req #1 is done\\n\\n   kfree(id_priv)\\n\\n\\t\\t\\t process_one_req(): for #2\\n                          addr_handler():\\n\\t                    mutex_lock(\u0026id_priv-\u003ehandler_mutex);\\n                            !! Use after free on id_priv\\n\\nrdma_addr_cancel() expects there to be one req on the list and only\\ncancels the first one. The self-removal behavior of the work only happens\\nafter the handler has returned. This yields a situations where the\\nreq_list can have two reqs for the same \\\"handle\\\" but rdma_addr_cancel()\\nonly cancels the first one.\\n\\nThe second req remains active beyond rdma_destroy_id() and will\\nuse-after-free id_priv once it inevitably triggers.\\n\\nFix this by remembering if the id_priv has called rdma_resolve_ip() and\\nalways cancel before calling it again. This ensures the req_list never\\ngets more than one item in it and doesn\u0027t cost anything in the normal flow\\nthat never uses this strange error path.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.188\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14.10\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15\", \"versionStartIncluding\": \"2.6.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:10:00.803Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47391\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T07:10:00.803Z\", \"dateReserved\": \"2024-05-21T14:58:30.813Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:03:49.545Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.