CVE-2024-47695
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-47695
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-47695.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-47695
- Downstream
- Related
- Published
- 2024-10-21T12:15:06Z
- Modified
- 2025-08-09T20:01:26Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
In the function initconns(), after the createcon() and createcm() for loop if something fails. In the cleanup for loop after the destroy tag, we access out of bound memory because cid is set to cltpath->s.con_num.
This commits resets the cid to cltpath->s.connum - 1, to stay in bounds in the cleanup loop later.
- References
-
- https://git.kernel.org/stable/c/01b9be936ee8839ab9f83a7e84ee02ac6c8303c4
- https://git.kernel.org/stable/c/0429a4e972082e3a2351da414b1c017daaf8aed2
- https://git.kernel.org/stable/c/1c50e0265fa332c94a4a182e4efa0fc70d8fad94
- https://git.kernel.org/stable/c/3e4289b29e216a55d08a89e126bc0b37cbad9f38
- https://git.kernel.org/stable/c/5ac73f8191f3de41fef4f934d84d97f3aadb301f
- https://git.kernel.org/stable/c/c8b7f3d9fada0d4b4b7db86bf7345cd61f1d972e