An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctxlist in some ucmamigrateid situations where ucmaclose is called, aka CID-f5449e74802c.
[
{
"id": "CVE-2020-36385-2790129a",
"signature_type": "Function",
"digest": {
"length": 259.0,
"function_hash": "332884182098067375444214446863264579266"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f5449e74802c1112dea984aec8af7a33c4516af1",
"target": {
"function": "ucma_lock_files",
"file": "drivers/infiniband/core/ucma.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2020-36385-8c9c5f5f",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"101035869631517153821026664066496234564",
"91809379214254238602076012257942558054",
"281793371628416281840637826155292004835",
"72927264990472026683807282980060944097",
"94830275867906055266589313849754719146",
"137019464989471486657833585936673636007",
"58282405914919362142025170246407603363",
"114174776812505415955717109844351753216",
"48677058431187520474297721116786058610",
"305164718753922187354545391859346719832",
"268106801392002670908591003333786016719",
"266127610199947818315129651745957083178",
"5931938154447656901149752461232748691",
"292705023439914671324169389293876771854",
"47872085784882705107318804853081471477",
"214750094256120392234434374433715137368",
"29952268169381190770998338447452911107",
"187932805578135164187032347879534112910",
"103283173312706564306298391903747315807",
"162872781509258995737303717252774954990",
"179462191077493166433881642238138109292",
"293437666303628975800583351418738710817",
"77269385885788529803296952540103064749",
"51771863478977448114962267681660338783",
"216265467250606063060417583563696683834",
"267600018310489210587870933233694187489",
"49631994647168256162865149689900278561",
"209486020125521863378915103884410086957",
"297752183008283558155516858902849970977",
"179597077583050064553793307276530269443",
"42567508398115957045482674082867212929",
"78446557167027079405307289460816263181",
"222025871674280694788251688857498404243",
"199427528580049337015828999354374813369",
"294910218024017848507122238708288899584",
"72031262135444124994226355110056914510",
"189865135311758755755537763077377794430",
"28728569755283278768671414731999697994",
"149689051933496538640427534868944355021",
"121516901318291261097958412237103167160",
"47355488264266929393417937791454157818",
"302938893513266768381529703943531746013",
"333770633075434992144860156585143473445",
"240433667293091186420774147678198880823",
"226632694065467045151450405847938079298",
"12737317467146422642781083118427377990",
"217914197522613707890604891726461767919",
"104374497998853626403793364864699474148",
"159353918368271194878228300014625918023",
"21809187509724545477936271401232575853",
"329027048382449995665793778909939436047",
"72031898907755573845337316915463334289",
"159282735345602401836062220867361512021",
"136989506936999605837469946570914269659",
"269927223830422647947774658825414111284",
"116929467411995092708011927125672032000",
"19327001084556333563466356626569020479",
"245960799421543776488595344535172257569",
"101412947240864688627249495983097450602",
"236104218030912320453273597717750596461",
"126180148037193971264443866316722454383",
"182744909237856967540964959639016036882",
"215491442485575359435361948974851038293",
"89201454121541813521170414758450915221",
"103324880062797197507594212751136580532",
"44621346164991837424423155238652479793"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f5449e74802c1112dea984aec8af7a33c4516af1",
"target": {
"file": "drivers/infiniband/core/ucma.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2020-36385-c155ddc4",
"signature_type": "Function",
"digest": {
"length": 1157.0,
"function_hash": "201875743724132559002474283872654876454"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f5449e74802c1112dea984aec8af7a33c4516af1",
"target": {
"function": "ucma_migrate_id",
"file": "drivers/infiniband/core/ucma.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2020-36385-c3d8ce77",
"signature_type": "Function",
"digest": {
"length": 242.0,
"function_hash": "141514506975756565995008947902372066305"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f5449e74802c1112dea984aec8af7a33c4516af1",
"target": {
"function": "ucma_move_events",
"file": "drivers/infiniband/core/ucma.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2020-36385-eeea842f",
"signature_type": "Function",
"digest": {
"length": 213.0,
"function_hash": "280538126601397642511147364744371856640"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f5449e74802c1112dea984aec8af7a33c4516af1",
"target": {
"function": "ucma_unlock_files",
"file": "drivers/infiniband/core/ucma.c"
},
"signature_version": "v1"
}
]