An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctxlist in some ucmamigrateid situations where ucmaclose is called, aka CID-f5449e74802c.
{ "vanir_signatures": [ { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_lock_files" }, "id": "CVE-2020-36385-2790129a", "digest": { "length": 259.0, "function_hash": "332884182098067375444214446863264579266" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f5449e74802c1112dea984aec8af7a33c4516af1" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/infiniband/core/ucma.c" }, "id": "CVE-2020-36385-8c9c5f5f", "digest": { "line_hashes": [ "101035869631517153821026664066496234564", "91809379214254238602076012257942558054", "281793371628416281840637826155292004835", "72927264990472026683807282980060944097", "94830275867906055266589313849754719146", "137019464989471486657833585936673636007", "58282405914919362142025170246407603363", "114174776812505415955717109844351753216", "48677058431187520474297721116786058610", "305164718753922187354545391859346719832", "268106801392002670908591003333786016719", "266127610199947818315129651745957083178", "5931938154447656901149752461232748691", "292705023439914671324169389293876771854", "47872085784882705107318804853081471477", "214750094256120392234434374433715137368", "29952268169381190770998338447452911107", "187932805578135164187032347879534112910", "103283173312706564306298391903747315807", "162872781509258995737303717252774954990", "179462191077493166433881642238138109292", "293437666303628975800583351418738710817", "77269385885788529803296952540103064749", "51771863478977448114962267681660338783", "216265467250606063060417583563696683834", "267600018310489210587870933233694187489", "49631994647168256162865149689900278561", "209486020125521863378915103884410086957", "297752183008283558155516858902849970977", "179597077583050064553793307276530269443", "42567508398115957045482674082867212929", "78446557167027079405307289460816263181", "222025871674280694788251688857498404243", "199427528580049337015828999354374813369", "294910218024017848507122238708288899584", "72031262135444124994226355110056914510", "189865135311758755755537763077377794430", "28728569755283278768671414731999697994", "149689051933496538640427534868944355021", "121516901318291261097958412237103167160", "47355488264266929393417937791454157818", "302938893513266768381529703943531746013", "333770633075434992144860156585143473445", "240433667293091186420774147678198880823", "226632694065467045151450405847938079298", "12737317467146422642781083118427377990", "217914197522613707890604891726461767919", "104374497998853626403793364864699474148", "159353918368271194878228300014625918023", "21809187509724545477936271401232575853", "329027048382449995665793778909939436047", "72031898907755573845337316915463334289", "159282735345602401836062220867361512021", "136989506936999605837469946570914269659", "269927223830422647947774658825414111284", "116929467411995092708011927125672032000", "19327001084556333563466356626569020479", "245960799421543776488595344535172257569", "101412947240864688627249495983097450602", "236104218030912320453273597717750596461", "126180148037193971264443866316722454383", "182744909237856967540964959639016036882", "215491442485575359435361948974851038293", "89201454121541813521170414758450915221", "103324880062797197507594212751136580532", "44621346164991837424423155238652479793" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f5449e74802c1112dea984aec8af7a33c4516af1" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_migrate_id" }, "id": "CVE-2020-36385-c155ddc4", "digest": { "length": 1157.0, "function_hash": "201875743724132559002474283872654876454" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f5449e74802c1112dea984aec8af7a33c4516af1" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_move_events" }, "id": "CVE-2020-36385-c3d8ce77", "digest": { "length": 242.0, "function_hash": "141514506975756565995008947902372066305" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f5449e74802c1112dea984aec8af7a33c4516af1" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/infiniband/core/ucma.c", "function": "ucma_unlock_files" }, "id": "CVE-2020-36385-eeea842f", "digest": { "length": 213.0, "function_hash": "280538126601397642511147364744371856640" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f5449e74802c1112dea984aec8af7a33c4516af1" } ] }