CVE-2021-47012
Assigner: Linux
Published: 2024-02-28T08:13:30.284Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix a use after free in siw_alloc_mr

Our code analyzer reported a UAF.

In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of
siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via
kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a
freed object. After, the execution continue up to the err_out branch of
siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr).

My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {}
section, to avoid the uaf.
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 2251334dcac9
lessThan: 30b9e92d0b5e
status: affected
versionType: git
version: 2251334dcac9
lessThan: 608a4b90ece0
status: affected
versionType: git
version: 2251334dcac9
lessThan: 3e22b88e02c1
status: affected
versionType: git
version: 2251334dcac9
lessThan: ad9ce7188432
status: affected
versionType: git
version: 2251334dcac9
lessThan: 3093ee182f01
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 5.3
status: affected
version: 0
lessThan: 5.3
status: unaffected
versionType: custom
version: 5.4.119
lessThanOrEqual: 5.4.*
status: unaffected
versionType: custom
version: 5.10.37
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.11.21
lessThanOrEqual: 5.11.*
status: unaffected
versionType: custom
version: 5.12.4
lessThanOrEqual: 5.12.*
status: unaffected
versionType: custom
version: 5.13
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: RDMA/siw: Fix a use after free in siw_alloc_mr
x_generator: engine: bippy-c298863b1525