CVE-2021-47012
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-47012
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-47012.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-47012
- Related
- Published
- 2024-02-28T09:15:38Z
- Modified
- 2024-09-11T02:00:06Z
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix a use after free in siwallocmr
Our code analyzer reported a UAF.
In siwallocmr(), it calls siwmraddmem(mr,..). In the implementation of siwmraddmem(), mem is assigned to mr->mem and then mem is freed via kfree(mem) if xaalloccyclic() failed. Here, mr->mem still point to a freed object. After, the execution continue up to the errout branch of siwallocmr, and the freed mr->mem is used in siwmrdropmem(mr).
My patch moves "mr->mem = mem" behind the if (xaalloccyclic(..)<0) {} section, to avoid the uaf.
- References
-
- https://git.kernel.org/stable/c/3093ee182f01689b89e9f8797b321603e5de4f63
- https://git.kernel.org/stable/c/30b9e92d0b5e5d5dc1101ab856c17009537cbca4
- https://git.kernel.org/stable/c/3e22b88e02c194f6c80867abfef5cc09383461f4
- https://git.kernel.org/stable/c/608a4b90ece039940e9425ee2b39c8beff27e00c
- https://git.kernel.org/stable/c/ad9ce7188432650469a6c7625bf479f5ed0b6155
- https://security-tracker.debian.org/tracker/CVE-2021-47012
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source