In the Linux kernel, the following vulnerability has been resolved:
RDMA/hns: Fix UAF for cq async event
The refcount of CQ is not protected by locks. When CQ asynchronous events and CQ destruction are concurrent, CQ may have been released, which will cause UAF.
Use the xa_lock() to protect the CQ refcount.
[
{
"digest": {
"length": 847.0,
"function_hash": "328878566101971031380963060930519500598"
},
"target": {
"function": "hns_roce_cq_event",
"file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63da190eeb5c9d849b71f457b15b308c94cbaf08",
"id": "CVE-2024-38545-04d64163"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"150022146586092114269707316884980129780",
"259941816791018425212685857027050051948",
"276800501565421088578629671510982685516",
"239190705403133340188607436109003807809",
"190051088301258399164306633145336614831",
"304252279091863824723824885022675737270",
"306957690602838235968643174911392098326",
"223131489566736076260270519701500264451",
"139540493965301801046541700236092571536",
"254818285379337730250349269302644899405",
"141214421279169041937596814957599801352",
"164694525217484956357358021065645693872",
"319123262897697405738387845306487558977",
"125220963372482319463386032128221709522",
"263978852273211167390618627560776733805",
"165553670562746577262184884104251137693",
"102215822090716214357700884425175048447",
"56093461386659495513089494323300453641",
"153670263383740452924910729855204841953",
"57753656654212471562298635357545817033",
"252014924186175087152474274299008756641",
"103721942702782881956169269642528108566",
"257588518837618652319229768443188487496",
"314451737949647559613163793774694710688",
"124566429858265701757663837572967243809"
]
},
"target": {
"file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@763780ef0336a973e933e40e919339381732dcaf",
"id": "CVE-2024-38545-07d6e148"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"150022146586092114269707316884980129780",
"259941816791018425212685857027050051948",
"276800501565421088578629671510982685516",
"239190705403133340188607436109003807809",
"190051088301258399164306633145336614831",
"304252279091863824723824885022675737270",
"306957690602838235968643174911392098326",
"223131489566736076260270519701500264451",
"139540493965301801046541700236092571536",
"254818285379337730250349269302644899405",
"141214421279169041937596814957599801352",
"164694525217484956357358021065645693872",
"319123262897697405738387845306487558977",
"125220963372482319463386032128221709522",
"263978852273211167390618627560776733805",
"165553670562746577262184884104251137693",
"102215822090716214357700884425175048447",
"56093461386659495513089494323300453641",
"153670263383740452924910729855204841953",
"57753656654212471562298635357545817033",
"252014924186175087152474274299008756641",
"103721942702782881956169269642528108566",
"257588518837618652319229768443188487496",
"314451737949647559613163793774694710688",
"124566429858265701757663837572967243809"
]
},
"target": {
"file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37a7559dc1358a8d300437e99ed8ecdab0671507",
"id": "CVE-2024-38545-1cd108fb"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"293248199236357794556233487608275608497",
"104122038226177879229016622689820046003",
"276800501565421088578629671510982685516",
"239190705403133340188607436109003807809",
"249956381376266935573820491825269595914",
"304252279091863824723824885022675737270",
"306957690602838235968643174911392098326",
"279991319767966257285084652006119712232",
"139540493965301801046541700236092571536",
"254818285379337730250349269302644899405",
"141214421279169041937596814957599801352",
"164694525217484956357358021065645693872",
"319123262897697405738387845306487558977",
"125220963372482319463386032128221709522",
"263978852273211167390618627560776733805",
"165553670562746577262184884104251137693",
"102215822090716214357700884425175048447",
"56093461386659495513089494323300453641",
"153670263383740452924910729855204841953",
"57753656654212471562298635357545817033",
"252014924186175087152474274299008756641",
"103721942702782881956169269642528108566",
"257588518837618652319229768443188487496",
"314451737949647559613163793774694710688",
"124566429858265701757663837572967243809"
]
},
"target": {
"file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@330c825e66ef65278e4ebe57fd49c1d6f3f4e34e",
"id": "CVE-2024-38545-2ad74982"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"150022146586092114269707316884980129780",
"259941816791018425212685857027050051948",
"276800501565421088578629671510982685516",
"239190705403133340188607436109003807809",
"190051088301258399164306633145336614831",
"304252279091863824723824885022675737270",
"306957690602838235968643174911392098326",
"223131489566736076260270519701500264451",
"139540493965301801046541700236092571536",
"254818285379337730250349269302644899405",
"141214421279169041937596814957599801352",
"164694525217484956357358021065645693872",
"319123262897697405738387845306487558977",
"125220963372482319463386032128221709522",
"263978852273211167390618627560776733805",
"165553670562746577262184884104251137693",
"102215822090716214357700884425175048447",
"56093461386659495513089494323300453641",
"153670263383740452924910729855204841953",
"57753656654212471562298635357545817033",
"252014924186175087152474274299008756641",
"103721942702782881956169269642528108566",
"257588518837618652319229768443188487496",
"314451737949647559613163793774694710688",
"124566429858265701757663837572967243809"
]
},
"target": {
"file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a942ec2745ca864cd8512142100e4027dc306a42",
"id": "CVE-2024-38545-31bd40df"
},
{
"digest": {
"length": 847.0,
"function_hash": "328878566101971031380963060930519500598"
},
"target": {
"function": "hns_roce_cq_event",
"file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@763780ef0336a973e933e40e919339381732dcaf",
"id": "CVE-2024-38545-3441cc5a"
},
{
"digest": {
"length": 847.0,
"function_hash": "328878566101971031380963060930519500598"
},
"target": {
"function": "hns_roce_cq_event",
"file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a942ec2745ca864cd8512142100e4027dc306a42",
"id": "CVE-2024-38545-3f838857"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"150022146586092114269707316884980129780",
"259941816791018425212685857027050051948",
"276800501565421088578629671510982685516",
"239190705403133340188607436109003807809",
"190051088301258399164306633145336614831",
"304252279091863824723824885022675737270",
"306957690602838235968643174911392098326",
"223131489566736076260270519701500264451",
"139540493965301801046541700236092571536",
"254818285379337730250349269302644899405",
"141214421279169041937596814957599801352",
"164694525217484956357358021065645693872",
"319123262897697405738387845306487558977",
"125220963372482319463386032128221709522",
"263978852273211167390618627560776733805",
"165553670562746577262184884104251137693",
"102215822090716214357700884425175048447",
"56093461386659495513089494323300453641",
"153670263383740452924910729855204841953",
"57753656654212471562298635357545817033",
"252014924186175087152474274299008756641",
"103721942702782881956169269642528108566",
"257588518837618652319229768443188487496",
"314451737949647559613163793774694710688",
"124566429858265701757663837572967243809"
]
},
"target": {
"file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39d26cf46306bdc7ae809ecfdbfeff5aa1098911",
"id": "CVE-2024-38545-570bf2db"
},
{
"digest": {
"length": 847.0,
"function_hash": "328878566101971031380963060930519500598"
},
"target": {
"function": "hns_roce_cq_event",
"file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@330c825e66ef65278e4ebe57fd49c1d6f3f4e34e",
"id": "CVE-2024-38545-5c1a5d46"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"150022146586092114269707316884980129780",
"259941816791018425212685857027050051948",
"276800501565421088578629671510982685516",
"239190705403133340188607436109003807809",
"190051088301258399164306633145336614831",
"304252279091863824723824885022675737270",
"306957690602838235968643174911392098326",
"223131489566736076260270519701500264451",
"139540493965301801046541700236092571536",
"254818285379337730250349269302644899405",
"141214421279169041937596814957599801352",
"164694525217484956357358021065645693872",
"319123262897697405738387845306487558977",
"125220963372482319463386032128221709522",
"263978852273211167390618627560776733805",
"165553670562746577262184884104251137693",
"102215822090716214357700884425175048447",
"56093461386659495513089494323300453641",
"153670263383740452924910729855204841953",
"57753656654212471562298635357545817033",
"252014924186175087152474274299008756641",
"103721942702782881956169269642528108566",
"257588518837618652319229768443188487496",
"314451737949647559613163793774694710688",
"124566429858265701757663837572967243809"
]
},
"target": {
"file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63da190eeb5c9d849b71f457b15b308c94cbaf08",
"id": "CVE-2024-38545-6511a89e"
},
{
"digest": {
"length": 847.0,
"function_hash": "328878566101971031380963060930519500598"
},
"target": {
"function": "hns_roce_cq_event",
"file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39d26cf46306bdc7ae809ecfdbfeff5aa1098911",
"id": "CVE-2024-38545-a20b04d3"
},
{
"digest": {
"length": 847.0,
"function_hash": "328878566101971031380963060930519500598"
},
"target": {
"function": "hns_roce_cq_event",
"file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37a7559dc1358a8d300437e99ed8ecdab0671507",
"id": "CVE-2024-38545-d432a82d"
}
]