Homepage

CVE-2021-47391 Affecting kernel-livepatch-5_3_18-150300_59_164-default package, versions <1-150300.7.3.1

Severity

 Recommended
0.0
high
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.05% (18th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES153-KERNELLIVEPATCH531815030059164DEFAULT-7366088
  • published25 Jun 2024
  • disclosed24 Jun 2024
Report a new vulnerability Found a mistake?

Introduced: 24 Jun 2024

CVE-2021-47391  (opens in a new tab)

How to fix?

Upgrade SLES:15.3 kernel-livepatch-5_3_18-150300_59_164-default to version 1-150300.7.3.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-livepatch-5_3_18-150300_59_164-default package and not the kernel-livepatch-5_3_18-150300_59_164-default package as distributed by SLES. See How to fix? for SLES:15.3 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests

The FSM can run in a circle allowing rdma_resolve_ip() to be called twice on the same id_priv. While this cannot happen without going through the work, it violates the invariant that the same address resolution background request cannot be active twice.

   CPU 1                                  CPU 2

rdma_resolve_addr(): RDMA_CM_IDLE -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) #1

         process_one_req(): for #1
                      addr_handler():
                        RDMA_CM_ADDR_QUERY -&gt; RDMA_CM_ADDR_BOUND
                        mutex_unlock(&amp;id_priv-&gt;handler_mutex);
                        [.. handler still running ..]

rdma_resolve_addr(): RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) !! two requests are now on the req_list

rdma_destroy_id(): destroy_id_handler_unlock(): _destroy_id(): cma_cancel_operation(): rdma_addr_cancel()

                      // process_one_req() self removes it
              spin_lock_bh(&amp;lock);
                       cancel_delayed_work(&amp;req-&gt;work);
                   if (!list_empty(&amp;req-&gt;list)) == true


  ! rdma_addr_cancel() returns after process_on_req #1 is done

kfree(id_priv)

         process_one_req(): for #2
                      addr_handler():
                    mutex_lock(&amp;id_priv-&gt;handler_mutex);
                        !! Use after free on id_priv

rdma_addr_cancel() expects there to be one req on the list and only cancels the first one. The self-removal behavior of the work only happens after the handler has returned. This yields a situations where the req_list can have two reqs for the same "handle" but rdma_addr_cancel() only cancels the first one.

The second req remains active beyond rdma_destroy_id() and will use-after-free id_priv once it inevitably triggers.

Fix this by remembering if the id_priv has called rdma_resolve_ip() and always cancel before calling it again. This ensures the req_list never gets more than one item in it and doesn't cost anything in the normal flow that never uses this strange error path.

CVSS Scores

version 3.1