GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-47687 (GCVE-0-2024-47687)

Vulnerability from cvelistv5 – Published: 2024-10-21 11:53 – Updated: 2026-05-11 20:38
VLAI
Title
vdpa/mlx5: Fix invalid mr resource destroy
Summary
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix invalid mr resource destroy Certain error paths from mlx5_vdpa_dev_add() can end up releasing mr resources which never got initialized in the first place. This patch adds the missing check in mlx5_vdpa_destroy_mr_resources() to block releasing non-initialized mr resources. Reference trace: mlx5_core 0000:08:00.2: mlx5_vdpa_dev_add:3274:(pid 2700) warning: No mac address provisioned? BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 140216067 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 8 PID: 2700 Comm: vdpa Kdump: loaded Not tainted 5.14.0-496.el9.x86_64 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb] Code: [...] RSP: 0018:ff1c823ac23077f0 EFLAGS: 00010246 RAX: ffffffffc1a21a60 RBX: ffffffff899567a0 RCX: 0000000000000000 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000000 RBP: ff1bda1f7c21e800 R08: 0000000000000000 R09: ff1c823ac2307670 R10: ff1c823ac2307668 R11: ffffffff8a9e7b68 R12: 0000000000000000 R13: 0000000000000000 R14: ff1bda1f43e341a0 R15: 00000000ffffffea FS: 00007f56eba7c740(0000) GS:ff1bda269f800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000104d90001 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa] ? __die_body.cold+0x8/0xd ? page_fault_oops+0x134/0x170 ? __irq_work_queue_local+0x2b/0xc0 ? irq_work_queue+0x2c/0x50 ? exc_page_fault+0x62/0x150 ? asm_exc_page_fault+0x22/0x30 ? __pfx_mlx5_vdpa_free+0x10/0x10 [mlx5_vdpa] ? vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb] mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa] vdpa_release_dev+0x1e/0x50 [vdpa] device_release+0x31/0x90 kobject_cleanup+0x37/0x130 mlx5_vdpa_dev_add+0x2d2/0x7a0 [mlx5_vdpa] vdpa_nl_cmd_dev_add_set_doit+0x277/0x4c0 [vdpa] genl_family_rcv_msg_doit+0xd9/0x130 genl_family_rcv_msg+0x14d/0x220 ? __pfx_vdpa_nl_cmd_dev_add_set_doit+0x10/0x10 [vdpa] ? _copy_to_user+0x1a/0x30 ? move_addr_to_user+0x4b/0xe0 genl_rcv_msg+0x47/0xa0 ? __import_iovec+0x46/0x150 ? __pfx_genl_rcv_msg+0x10/0x10 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x245/0x370 netlink_sendmsg+0x206/0x440 __sys_sendto+0x1dc/0x1f0 ? do_read_fault+0x10c/0x1d0 ? do_pte_missing+0x10d/0x190 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x5c/0xf0 ? __count_memcg_events+0x4f/0xb0 ? mm_account_fault+0x6c/0x100 ? handle_mm_fault+0x116/0x270 ? do_user_addr_fault+0x1d6/0x6a0 ? do_syscall_64+0x6b/0xf0 ? clear_bhb_loop+0x25/0x80 ? clear_bhb_loop+0x25/0x80 ? clear_bhb_loop+0x25/0x80 ? clear_bhb_loop+0x25/0x80 ? clear_bhb_loop+0x25/0x80 entry_SYSCALL_64_after_hwframe+0x78/0x80
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 13:06 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 512c0cdd80c19ec11f6dbe769d5899dcfefcd5c9 , < b6fbb1c7801f46a0e5461c02904eab0d7535c790 (git)
Affected: 512c0cdd80c19ec11f6dbe769d5899dcfefcd5c9 , < 5fe351def237df1ad29aa8af574350bc5340b4cf (git)
Affected: 512c0cdd80c19ec11f6dbe769d5899dcfefcd5c9 , < dc12502905b7a3de9097ea6b98870470c2921e09 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47687",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:06:29.452318Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:14:15.726Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vdpa/mlx5/core/mr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b6fbb1c7801f46a0e5461c02904eab0d7535c790",
              "status": "affected",
              "version": "512c0cdd80c19ec11f6dbe769d5899dcfefcd5c9",
              "versionType": "git"
            },
            {
              "lessThan": "5fe351def237df1ad29aa8af574350bc5340b4cf",
              "status": "affected",
              "version": "512c0cdd80c19ec11f6dbe769d5899dcfefcd5c9",
              "versionType": "git"
            },
            {
              "lessThan": "dc12502905b7a3de9097ea6b98870470c2921e09",
              "status": "affected",
              "version": "512c0cdd80c19ec11f6dbe769d5899dcfefcd5c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vdpa/mlx5/core/mr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa/mlx5: Fix invalid mr resource destroy\n\nCertain error paths from mlx5_vdpa_dev_add() can end up releasing mr\nresources which never got initialized in the first place.\n\nThis patch adds the missing check in mlx5_vdpa_destroy_mr_resources()\nto block releasing non-initialized mr resources.\n\nReference trace:\n\n  mlx5_core 0000:08:00.2: mlx5_vdpa_dev_add:3274:(pid 2700) warning: No mac address provisioned?\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 140216067 P4D 0\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 8 PID: 2700 Comm: vdpa Kdump: loaded Not tainted 5.14.0-496.el9.x86_64 #1\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n  RIP: 0010:vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb]\n  Code: [...]\n  RSP: 0018:ff1c823ac23077f0 EFLAGS: 00010246\n  RAX: ffffffffc1a21a60 RBX: ffffffff899567a0 RCX: 0000000000000000\n  RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000000\n  RBP: ff1bda1f7c21e800 R08: 0000000000000000 R09: ff1c823ac2307670\n  R10: ff1c823ac2307668 R11: ffffffff8a9e7b68 R12: 0000000000000000\n  R13: 0000000000000000 R14: ff1bda1f43e341a0 R15: 00000000ffffffea\n  FS:  00007f56eba7c740(0000) GS:ff1bda269f800000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000000000000 CR3: 0000000104d90001 CR4: 0000000000771ef0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  PKRU: 55555554\n  Call Trace:\n\n   ? show_trace_log_lvl+0x1c4/0x2df\n   ? show_trace_log_lvl+0x1c4/0x2df\n   ? mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa]\n   ? __die_body.cold+0x8/0xd\n   ? page_fault_oops+0x134/0x170\n   ? __irq_work_queue_local+0x2b/0xc0\n   ? irq_work_queue+0x2c/0x50\n   ? exc_page_fault+0x62/0x150\n   ? asm_exc_page_fault+0x22/0x30\n   ? __pfx_mlx5_vdpa_free+0x10/0x10 [mlx5_vdpa]\n   ? vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb]\n   mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa]\n   vdpa_release_dev+0x1e/0x50 [vdpa]\n   device_release+0x31/0x90\n   kobject_cleanup+0x37/0x130\n   mlx5_vdpa_dev_add+0x2d2/0x7a0 [mlx5_vdpa]\n   vdpa_nl_cmd_dev_add_set_doit+0x277/0x4c0 [vdpa]\n   genl_family_rcv_msg_doit+0xd9/0x130\n   genl_family_rcv_msg+0x14d/0x220\n   ? __pfx_vdpa_nl_cmd_dev_add_set_doit+0x10/0x10 [vdpa]\n   ? _copy_to_user+0x1a/0x30\n   ? move_addr_to_user+0x4b/0xe0\n   genl_rcv_msg+0x47/0xa0\n   ? __import_iovec+0x46/0x150\n   ? __pfx_genl_rcv_msg+0x10/0x10\n   netlink_rcv_skb+0x54/0x100\n   genl_rcv+0x24/0x40\n   netlink_unicast+0x245/0x370\n   netlink_sendmsg+0x206/0x440\n   __sys_sendto+0x1dc/0x1f0\n   ? do_read_fault+0x10c/0x1d0\n   ? do_pte_missing+0x10d/0x190\n   __x64_sys_sendto+0x20/0x30\n   do_syscall_64+0x5c/0xf0\n   ? __count_memcg_events+0x4f/0xb0\n   ? mm_account_fault+0x6c/0x100\n   ? handle_mm_fault+0x116/0x270\n   ? do_user_addr_fault+0x1d6/0x6a0\n   ? do_syscall_64+0x6b/0xf0\n   ? clear_bhb_loop+0x25/0x80\n   ? clear_bhb_loop+0x25/0x80\n   ? clear_bhb_loop+0x25/0x80\n   ? clear_bhb_loop+0x25/0x80\n   ? clear_bhb_loop+0x25/0x80\n   entry_SYSCALL_64_after_hwframe+0x78/0x80"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:38:49.350Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b6fbb1c7801f46a0e5461c02904eab0d7535c790"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fe351def237df1ad29aa8af574350bc5340b4cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc12502905b7a3de9097ea6b98870470c2921e09"
        }
      ],
      "title": "vdpa/mlx5: Fix invalid mr resource destroy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47687",
    "datePublished": "2024-10-21T11:53:27.834Z",
    "dateReserved": "2024-09-30T16:00:12.941Z",
    "dateUpdated": "2026-05-11T20:38:49.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47687",
      "date": "2026-09-16",
      "epss": "0.00235",
      "percentile": "0.14578"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.13\", \"matchCriteriaId\": \"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.2\", \"matchCriteriaId\": \"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvdpa/mlx5: Fix invalid mr resource destroy\\n\\nCertain error paths from mlx5_vdpa_dev_add() can end up releasing mr\\nresources which never got initialized in the first place.\\n\\nThis patch adds the missing check in mlx5_vdpa_destroy_mr_resources()\\nto block releasing non-initialized mr resources.\\n\\nReference trace:\\n\\n  mlx5_core 0000:08:00.2: mlx5_vdpa_dev_add:3274:(pid 2700) warning: No mac address provisioned?\\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 140216067 P4D 0\\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\\n  CPU: 8 PID: 2700 Comm: vdpa Kdump: loaded Not tainted 5.14.0-496.el9.x86_64 #1\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\n  RIP: 0010:vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb]\\n  Code: [...]\\n  RSP: 0018:ff1c823ac23077f0 EFLAGS: 00010246\\n  RAX: ffffffffc1a21a60 RBX: ffffffff899567a0 RCX: 0000000000000000\\n  RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000000\\n  RBP: ff1bda1f7c21e800 R08: 0000000000000000 R09: ff1c823ac2307670\\n  R10: ff1c823ac2307668 R11: ffffffff8a9e7b68 R12: 0000000000000000\\n  R13: 0000000000000000 R14: ff1bda1f43e341a0 R15: 00000000ffffffea\\n  FS:  00007f56eba7c740(0000) GS:ff1bda269f800000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 0000000000000000 CR3: 0000000104d90001 CR4: 0000000000771ef0\\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n  PKRU: 55555554\\n  Call Trace:\\n\\n   ? show_trace_log_lvl+0x1c4/0x2df\\n   ? show_trace_log_lvl+0x1c4/0x2df\\n   ? mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa]\\n   ? __die_body.cold+0x8/0xd\\n   ? page_fault_oops+0x134/0x170\\n   ? __irq_work_queue_local+0x2b/0xc0\\n   ? irq_work_queue+0x2c/0x50\\n   ? exc_page_fault+0x62/0x150\\n   ? asm_exc_page_fault+0x22/0x30\\n   ? __pfx_mlx5_vdpa_free+0x10/0x10 [mlx5_vdpa]\\n   ? vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb]\\n   mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa]\\n   vdpa_release_dev+0x1e/0x50 [vdpa]\\n   device_release+0x31/0x90\\n   kobject_cleanup+0x37/0x130\\n   mlx5_vdpa_dev_add+0x2d2/0x7a0 [mlx5_vdpa]\\n   vdpa_nl_cmd_dev_add_set_doit+0x277/0x4c0 [vdpa]\\n   genl_family_rcv_msg_doit+0xd9/0x130\\n   genl_family_rcv_msg+0x14d/0x220\\n   ? __pfx_vdpa_nl_cmd_dev_add_set_doit+0x10/0x10 [vdpa]\\n   ? _copy_to_user+0x1a/0x30\\n   ? move_addr_to_user+0x4b/0xe0\\n   genl_rcv_msg+0x47/0xa0\\n   ? __import_iovec+0x46/0x150\\n   ? __pfx_genl_rcv_msg+0x10/0x10\\n   netlink_rcv_skb+0x54/0x100\\n   genl_rcv+0x24/0x40\\n   netlink_unicast+0x245/0x370\\n   netlink_sendmsg+0x206/0x440\\n   __sys_sendto+0x1dc/0x1f0\\n   ? do_read_fault+0x10c/0x1d0\\n   ? do_pte_missing+0x10d/0x190\\n   __x64_sys_sendto+0x20/0x30\\n   do_syscall_64+0x5c/0xf0\\n   ? __count_memcg_events+0x4f/0xb0\\n   ? mm_account_fault+0x6c/0x100\\n   ? handle_mm_fault+0x116/0x270\\n   ? do_user_addr_fault+0x1d6/0x6a0\\n   ? do_syscall_64+0x6b/0xf0\\n   ? clear_bhb_loop+0x25/0x80\\n   ? clear_bhb_loop+0x25/0x80\\n   ? clear_bhb_loop+0x25/0x80\\n   ? clear_bhb_loop+0x25/0x80\\n   ? clear_bhb_loop+0x25/0x80\\n   entry_SYSCALL_64_after_hwframe+0x78/0x80\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vdpa/mlx5: Arreglar la destrucci\\u00f3n de recursos mr no v\\u00e1lida Ciertas rutas de error de mlx5_vdpa_dev_add() pueden terminar liberando recursos mr que nunca se inicializaron en primer lugar. Este parche agrega la comprobaci\\u00f3n faltante en mlx5_vdpa_destroy_mr_resources() para bloquear la liberaci\\u00f3n de recursos mr no inicializados. Rastreo de referencia: mlx5_core 0000:08:00.2: mlx5_vdpa_dev_add:3274:(pid 2700) advertencia: \\u00bfNo se ha aprovisionado ninguna direcci\\u00f3n MAC? ERROR: desreferencia de puntero NULL del kernel, direcci\\u00f3n: 0000000000000000 #PF: acceso de lectura del supervisor en modo kernel #PF: error_code(0x0000) - p\\u00e1gina no presente PGD 140216067 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 8 PID: 2700 Comm: vdpa Kdump: cargado No contaminado 5.14.0-496.el9.x86_64 #1 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb] C\\u00f3digo: [...] RSP: 0018:ff1c823ac23077f0 EFLAGS: 00010246 RAX: ffffffffc1a21a60 RBX: ffffffff899567a0 RCX: 0000000000000000 RDX: ffffffffffffffff RSI: 000000000000000 RDI: 000000000000000 RBP: ff1bda1f7c21e800 R08: 0000000000000000 R09: ff1c823ac2307670 R10: ff1c823ac2307668 R11: ffffffff8a9e7b68 R12: 0000000000000000 R13: 0000000000000000 R14: ff1bda1f43e341a0 R15: 00000000ffffffea FS: 00007f56eba7c740(0000) GS:ff1bda269f800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000080050033 CR2: 000000000000000 CR3: 0000000104d90001 CR4: 00000000000771ef0 DR0: 00000000000000000 DR1: 00000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Seguimiento de llamadas: ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa] ? __die_body.cold+0x8/0xd ? error_p\\u00e1gina_oops+0x134/0x170 ? __irq_work_queue_local+0x2b/0xc0 ? irq_work_queue+0x2c/0x50 ? error_p\\u00e1gina_oops+0x62/0x150 ? error_p\\u00e1gina_oops+0x134/0x170 ? vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb] mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa] vdpa_release_dev+0x1e/0x50 [vdpa] device_release+0x31/0x90 kobject_cleanup+0x37/0x130 mlx5_vdpa_dev_add+0x2d2/0x7a0 [mlx5_vdpa] vdpa_nl_cmd_dev_add_set_doit+0x277/0x4c0 [vdpa] genl_family_rcv_msg_doit+0xd9/0x130 genl_family_rcv_msg+0x14d/0x220 ? __pfx_vdpa_nl_cmd_dev_add_set_doit+0x10/0x10 [vdpa] ? _copiar_al_usuario+0x1a/0x30 ? mover_direcci\\u00f3n_al_usuario+0x4b/0xe0 genl_rcv_msg+0x47/0xa0 ? __importar_iovec+0x46/0x150 ? __pfx_genl_rcv_msg+0x10/0x10 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x245/0x370 netlink_sendmsg+0x206/0x440 __sys_sendto+0x1dc/0x1f0 ? borrar_bucle_bhb+0x25/0x80 ? borrar_bucle_bhb+0x25/0x80 ? borrar_bucle_bhb+0x25/0x80 ? borrar_bucle_bhb+0x25/0x80 ? borrar_bucle_bhb+0x25/0x80 entrada_SYSCALL_64_despu\\u00e9s_hwframe+0x78/0x80\"}]",
      "id": "CVE-2024-47687",
      "lastModified": "2024-10-23T15:22:45.867",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T12:15:05.580",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/5fe351def237df1ad29aa8af574350bc5340b4cf\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b6fbb1c7801f46a0e5461c02904eab0d7535c790\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dc12502905b7a3de9097ea6b98870470c2921e09\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-908\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47687\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T12:15:05.580\",\"lastModified\":\"2026-06-17T07:57:32.503\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvdpa/mlx5: Fix invalid mr resource destroy\\n\\nCertain error paths from mlx5_vdpa_dev_add() can end up releasing mr\\nresources which never got initialized in the first place.\\n\\nThis patch adds the missing check in mlx5_vdpa_destroy_mr_resources()\\nto block releasing non-initialized mr resources.\\n\\nReference trace:\\n\\n  mlx5_core 0000:08:00.2: mlx5_vdpa_dev_add:3274:(pid 2700) warning: No mac address provisioned?\\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 140216067 P4D 0\\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\\n  CPU: 8 PID: 2700 Comm: vdpa Kdump: loaded Not tainted 5.14.0-496.el9.x86_64 #1\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\n  RIP: 0010:vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb]\\n  Code: [...]\\n  RSP: 0018:ff1c823ac23077f0 EFLAGS: 00010246\\n  RAX: ffffffffc1a21a60 RBX: ffffffff899567a0 RCX: 0000000000000000\\n  RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000000\\n  RBP: ff1bda1f7c21e800 R08: 0000000000000000 R09: ff1c823ac2307670\\n  R10: ff1c823ac2307668 R11: ffffffff8a9e7b68 R12: 0000000000000000\\n  R13: 0000000000000000 R14: ff1bda1f43e341a0 R15: 00000000ffffffea\\n  FS:  00007f56eba7c740(0000) GS:ff1bda269f800000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 0000000000000000 CR3: 0000000104d90001 CR4: 0000000000771ef0\\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n  PKRU: 55555554\\n  Call Trace:\\n\\n   ? show_trace_log_lvl+0x1c4/0x2df\\n   ? show_trace_log_lvl+0x1c4/0x2df\\n   ? mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa]\\n   ? __die_body.cold+0x8/0xd\\n   ? page_fault_oops+0x134/0x170\\n   ? __irq_work_queue_local+0x2b/0xc0\\n   ? irq_work_queue+0x2c/0x50\\n   ? exc_page_fault+0x62/0x150\\n   ? asm_exc_page_fault+0x22/0x30\\n   ? __pfx_mlx5_vdpa_free+0x10/0x10 [mlx5_vdpa]\\n   ? vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb]\\n   mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa]\\n   vdpa_release_dev+0x1e/0x50 [vdpa]\\n   device_release+0x31/0x90\\n   kobject_cleanup+0x37/0x130\\n   mlx5_vdpa_dev_add+0x2d2/0x7a0 [mlx5_vdpa]\\n   vdpa_nl_cmd_dev_add_set_doit+0x277/0x4c0 [vdpa]\\n   genl_family_rcv_msg_doit+0xd9/0x130\\n   genl_family_rcv_msg+0x14d/0x220\\n   ? __pfx_vdpa_nl_cmd_dev_add_set_doit+0x10/0x10 [vdpa]\\n   ? _copy_to_user+0x1a/0x30\\n   ? move_addr_to_user+0x4b/0xe0\\n   genl_rcv_msg+0x47/0xa0\\n   ? __import_iovec+0x46/0x150\\n   ? __pfx_genl_rcv_msg+0x10/0x10\\n   netlink_rcv_skb+0x54/0x100\\n   genl_rcv+0x24/0x40\\n   netlink_unicast+0x245/0x370\\n   netlink_sendmsg+0x206/0x440\\n   __sys_sendto+0x1dc/0x1f0\\n   ? do_read_fault+0x10c/0x1d0\\n   ? do_pte_missing+0x10d/0x190\\n   __x64_sys_sendto+0x20/0x30\\n   do_syscall_64+0x5c/0xf0\\n   ? __count_memcg_events+0x4f/0xb0\\n   ? mm_account_fault+0x6c/0x100\\n   ? handle_mm_fault+0x116/0x270\\n   ? do_user_addr_fault+0x1d6/0x6a0\\n   ? do_syscall_64+0x6b/0xf0\\n   ? clear_bhb_loop+0x25/0x80\\n   ? clear_bhb_loop+0x25/0x80\\n   ? clear_bhb_loop+0x25/0x80\\n   ? clear_bhb_loop+0x25/0x80\\n   ? clear_bhb_loop+0x25/0x80\\n   entry_SYSCALL_64_after_hwframe+0x78/0x80\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vdpa/mlx5: Arreglar la destrucci\u00f3n de recursos mr no v\u00e1lida Ciertas rutas de error de mlx5_vdpa_dev_add() pueden terminar liberando recursos mr que nunca se inicializaron en primer lugar. Este parche agrega la comprobaci\u00f3n faltante en mlx5_vdpa_destroy_mr_resources() para bloquear la liberaci\u00f3n de recursos mr no inicializados. Rastreo de referencia: mlx5_core 0000:08:00.2: mlx5_vdpa_dev_add:3274:(pid 2700) advertencia: \u00bfNo se ha aprovisionado ninguna direcci\u00f3n MAC? ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000000 #PF: acceso de lectura del supervisor en modo kernel #PF: error_code(0x0000) - p\u00e1gina no presente PGD 140216067 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 8 PID: 2700 Comm: vdpa Kdump: cargado No contaminado 5.14.0-496.el9.x86_64 #1 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb] C\u00f3digo: [...] RSP: 0018:ff1c823ac23077f0 EFLAGS: 00010246 RAX: ffffffffc1a21a60 RBX: ffffffff899567a0 RCX: 0000000000000000 RDX: ffffffffffffffff RSI: 000000000000000 RDI: 000000000000000 RBP: ff1bda1f7c21e800 R08: 0000000000000000 R09: ff1c823ac2307670 R10: ff1c823ac2307668 R11: ffffffff8a9e7b68 R12: 0000000000000000 R13: 0000000000000000 R14: ff1bda1f43e341a0 R15: 00000000ffffffea FS: 00007f56eba7c740(0000) GS:ff1bda269f800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000080050033 CR2: 000000000000000 CR3: 0000000104d90001 CR4: 00000000000771ef0 DR0: 00000000000000000 DR1: 00000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Seguimiento de llamadas: ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa] ? __die_body.cold+0x8/0xd ? error_p\u00e1gina_oops+0x134/0x170 ? __irq_work_queue_local+0x2b/0xc0 ? irq_work_queue+0x2c/0x50 ? error_p\u00e1gina_oops+0x62/0x150 ? error_p\u00e1gina_oops+0x134/0x170 ? vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb] mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa] vdpa_release_dev+0x1e/0x50 [vdpa] device_release+0x31/0x90 kobject_cleanup+0x37/0x130 mlx5_vdpa_dev_add+0x2d2/0x7a0 [mlx5_vdpa] vdpa_nl_cmd_dev_add_set_doit+0x277/0x4c0 [vdpa] genl_family_rcv_msg_doit+0xd9/0x130 genl_family_rcv_msg+0x14d/0x220 ? __pfx_vdpa_nl_cmd_dev_add_set_doit+0x10/0x10 [vdpa] ? _copiar_al_usuario+0x1a/0x30 ? mover_direcci\u00f3n_al_usuario+0x4b/0xe0 genl_rcv_msg+0x47/0xa0 ? __importar_iovec+0x46/0x150 ? __pfx_genl_rcv_msg+0x10/0x10 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x245/0x370 netlink_sendmsg+0x206/0x440 __sys_sendto+0x1dc/0x1f0 ? borrar_bucle_bhb+0x25/0x80 ? borrar_bucle_bhb+0x25/0x80 ? borrar_bucle_bhb+0x25/0x80 ? borrar_bucle_bhb+0x25/0x80 ? borrar_bucle_bhb+0x25/0x80 entrada_SYSCALL_64_despu\u00e9s_hwframe+0x78/0x80\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/vdpa/mlx5/core/mr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"512c0cdd80c19ec11f6dbe769d5899dcfefcd5c9\",\"lessThan\":\"b6fbb1c7801f46a0e5461c02904eab0d7535c790\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"512c0cdd80c19ec11f6dbe769d5899dcfefcd5c9\",\"lessThan\":\"5fe351def237df1ad29aa8af574350bc5340b4cf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"512c0cdd80c19ec11f6dbe769d5899dcfefcd5c9\",\"lessThan\":\"dc12502905b7a3de9097ea6b98870470c2921e09\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/vdpa/mlx5/core/mr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T13:06:29.452318Z\",\"id\":\"CVE-2024-47687\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5fe351def237df1ad29aa8af574350bc5340b4cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b6fbb1c7801f46a0e5461c02904eab0d7535c790\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dc12502905b7a3de9097ea6b98870470c2921e09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T08:05:14+00:00",
      "cve": "CVE-2024-47687",
      "id": "CVE-2024-47687",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vdpa/mlx5: Fix invalid mr resource destroy",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47687.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:47:01Z",
      "cve": "CVE-2024-47687",
      "id": "CVE-2024-47687",
      "initial_release_date": "2024-10-21T15:47:41Z",
      "product_status:known_affected": "398",
      "product_status:known_not_affected": "474",
      "product_status:recommended": "410",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-47687",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-47687.json",
      "version": "64"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47687\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:06:29.452318Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:06:33.184Z\"}}], \"cna\": {\"title\": \"vdpa/mlx5: Fix invalid mr resource destroy\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"512c0cdd80c19ec11f6dbe769d5899dcfefcd5c9\", \"lessThan\": \"b6fbb1c7801f46a0e5461c02904eab0d7535c790\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"512c0cdd80c19ec11f6dbe769d5899dcfefcd5c9\", \"lessThan\": \"5fe351def237df1ad29aa8af574350bc5340b4cf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"512c0cdd80c19ec11f6dbe769d5899dcfefcd5c9\", \"lessThan\": \"dc12502905b7a3de9097ea6b98870470c2921e09\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/vdpa/mlx5/core/mr.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/vdpa/mlx5/core/mr.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b6fbb1c7801f46a0e5461c02904eab0d7535c790\"}, {\"url\": \"https://git.kernel.org/stable/c/5fe351def237df1ad29aa8af574350bc5340b4cf\"}, {\"url\": \"https://git.kernel.org/stable/c/dc12502905b7a3de9097ea6b98870470c2921e09\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvdpa/mlx5: Fix invalid mr resource destroy\\n\\nCertain error paths from mlx5_vdpa_dev_add() can end up releasing mr\\nresources which never got initialized in the first place.\\n\\nThis patch adds the missing check in mlx5_vdpa_destroy_mr_resources()\\nto block releasing non-initialized mr resources.\\n\\nReference trace:\\n\\n  mlx5_core 0000:08:00.2: mlx5_vdpa_dev_add:3274:(pid 2700) warning: No mac address provisioned?\\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 140216067 P4D 0\\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\\n  CPU: 8 PID: 2700 Comm: vdpa Kdump: loaded Not tainted 5.14.0-496.el9.x86_64 #1\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\n  RIP: 0010:vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb]\\n  Code: [...]\\n  RSP: 0018:ff1c823ac23077f0 EFLAGS: 00010246\\n  RAX: ffffffffc1a21a60 RBX: ffffffff899567a0 RCX: 0000000000000000\\n  RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000000\\n  RBP: ff1bda1f7c21e800 R08: 0000000000000000 R09: ff1c823ac2307670\\n  R10: ff1c823ac2307668 R11: ffffffff8a9e7b68 R12: 0000000000000000\\n  R13: 0000000000000000 R14: ff1bda1f43e341a0 R15: 00000000ffffffea\\n  FS:  00007f56eba7c740(0000) GS:ff1bda269f800000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 0000000000000000 CR3: 0000000104d90001 CR4: 0000000000771ef0\\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n  PKRU: 55555554\\n  Call Trace:\\n\\n   ? show_trace_log_lvl+0x1c4/0x2df\\n   ? show_trace_log_lvl+0x1c4/0x2df\\n   ? mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa]\\n   ? __die_body.cold+0x8/0xd\\n   ? page_fault_oops+0x134/0x170\\n   ? __irq_work_queue_local+0x2b/0xc0\\n   ? irq_work_queue+0x2c/0x50\\n   ? exc_page_fault+0x62/0x150\\n   ? asm_exc_page_fault+0x22/0x30\\n   ? __pfx_mlx5_vdpa_free+0x10/0x10 [mlx5_vdpa]\\n   ? vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb]\\n   mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa]\\n   vdpa_release_dev+0x1e/0x50 [vdpa]\\n   device_release+0x31/0x90\\n   kobject_cleanup+0x37/0x130\\n   mlx5_vdpa_dev_add+0x2d2/0x7a0 [mlx5_vdpa]\\n   vdpa_nl_cmd_dev_add_set_doit+0x277/0x4c0 [vdpa]\\n   genl_family_rcv_msg_doit+0xd9/0x130\\n   genl_family_rcv_msg+0x14d/0x220\\n   ? __pfx_vdpa_nl_cmd_dev_add_set_doit+0x10/0x10 [vdpa]\\n   ? _copy_to_user+0x1a/0x30\\n   ? move_addr_to_user+0x4b/0xe0\\n   genl_rcv_msg+0x47/0xa0\\n   ? __import_iovec+0x46/0x150\\n   ? __pfx_genl_rcv_msg+0x10/0x10\\n   netlink_rcv_skb+0x54/0x100\\n   genl_rcv+0x24/0x40\\n   netlink_unicast+0x245/0x370\\n   netlink_sendmsg+0x206/0x440\\n   __sys_sendto+0x1dc/0x1f0\\n   ? do_read_fault+0x10c/0x1d0\\n   ? do_pte_missing+0x10d/0x190\\n   __x64_sys_sendto+0x20/0x30\\n   do_syscall_64+0x5c/0xf0\\n   ? __count_memcg_events+0x4f/0xb0\\n   ? mm_account_fault+0x6c/0x100\\n   ? handle_mm_fault+0x116/0x270\\n   ? do_user_addr_fault+0x1d6/0x6a0\\n   ? do_syscall_64+0x6b/0xf0\\n   ? clear_bhb_loop+0x25/0x80\\n   ? clear_bhb_loop+0x25/0x80\\n   ? clear_bhb_loop+0x25/0x80\\n   ? clear_bhb_loop+0x25/0x80\\n   ? clear_bhb_loop+0x25/0x80\\n   entry_SYSCALL_64_after_hwframe+0x78/0x80\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:38:49.350Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47687\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:38:49.350Z\", \"dateReserved\": \"2024-09-30T16:00:12.941Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T11:53:27.834Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.