cve-2021-47615
Vulnerability from cvelistv5
Published
2024-06-19 14:58
Modified
2024-09-11 17:34
Severity
Summary
RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c44979ace49b4aede3cc7cb5542316e53a4005c9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e3bc4d4b50cae7db08e50dbe43f771c906e97701
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f0ae4afe3d35e67db042c58a52909e06262b740f
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:47:40.760Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e3bc4d4b50cae7db08e50dbe43f771c906e97701"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c44979ace49b4aede3cc7cb5542316e53a4005c9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f0ae4afe3d35e67db042c58a52909e06262b740f"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47615",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:11:48.925142Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:50.764Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/mlx5_ib.h",
            "drivers/infiniband/hw/mlx5/mr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e3bc4d4b50ca",
              "status": "affected",
              "version": "f18ec4223117",
              "versionType": "git"
            },
            {
              "lessThan": "c44979ace49b",
              "status": "affected",
              "version": "f18ec4223117",
              "versionType": "git"
            },
            {
              "lessThan": "f0ae4afe3d35",
              "status": "affected",
              "version": "f18ec4223117",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/mlx5_ib.h",
            "drivers/infiniband/hw/mlx5/mr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.10",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix releasing unallocated memory in dereg MR flow\n\nFor the case of IB_MR_TYPE_DM the mr does doesn\u0027t have a umem, even though\nit is a user MR. This causes function mlx5_free_priv_descs() to think that\nit is a kernel MR, leading to wrongly accessing mr-\u003edescs that will get\nwrong values in the union which leads to attempt to release resources that\nwere not allocated in the first place.\n\nFor example:\n DMA-API: mlx5_core 0000:08:00.1: device driver tries to free DMA memory it has not allocated [device address=0x0000000000000000] [size=0 bytes]\n WARNING: CPU: 8 PID: 1021 at kernel/dma/debug.c:961 check_unmap+0x54f/0x8b0\n RIP: 0010:check_unmap+0x54f/0x8b0\n Call Trace:\n  debug_dma_unmap_page+0x57/0x60\n  mlx5_free_priv_descs+0x57/0x70 [mlx5_ib]\n  mlx5_ib_dereg_mr+0x1fb/0x3d0 [mlx5_ib]\n  ib_dereg_mr_user+0x60/0x140 [ib_core]\n  uverbs_destroy_uobject+0x59/0x210 [ib_uverbs]\n  uobj_destroy+0x3f/0x80 [ib_uverbs]\n  ib_uverbs_cmd_verbs+0x435/0xd10 [ib_uverbs]\n  ? uverbs_finalize_object+0x50/0x50 [ib_uverbs]\n  ? lock_acquire+0xc4/0x2e0\n  ? lock_acquired+0x12/0x380\n  ? lock_acquire+0xc4/0x2e0\n  ? lock_acquire+0xc4/0x2e0\n  ? ib_uverbs_ioctl+0x7c/0x140 [ib_uverbs]\n  ? lock_release+0x28a/0x400\n  ib_uverbs_ioctl+0xc0/0x140 [ib_uverbs]\n  ? ib_uverbs_ioctl+0x7c/0x140 [ib_uverbs]\n  __x64_sys_ioctl+0x7f/0xb0\n  do_syscall_64+0x38/0x90\n\nFix it by reorganizing the dereg flow and mlx5_ib_mr structure:\n - Move the ib_umem field into the user MRs structure in the union as it\u0027s\n   applicable only there.\n - Function mlx5_ib_dereg_mr() will now call mlx5_free_priv_descs() only\n   in case there isn\u0027t udata, which indicates that this isn\u0027t a user MR."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-19T14:58:03.142Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e3bc4d4b50cae7db08e50dbe43f771c906e97701"
        },
        {
          "url": "https://git.kernel.org/stable/c/c44979ace49b4aede3cc7cb5542316e53a4005c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0ae4afe3d35e67db042c58a52909e06262b740f"
        }
      ],
      "title": "RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47615",
    "datePublished": "2024-06-19T14:58:03.142Z",
    "dateReserved": "2024-06-19T14:55:32.795Z",
    "dateUpdated": "2024-09-11T17:34:50.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47615\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T15:15:56.030\",\"lastModified\":\"2024-06-20T12:43:25.663\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/mlx5: Fix releasing unallocated memory in dereg MR flow\\n\\nFor the case of IB_MR_TYPE_DM the mr does doesn\u0027t have a umem, even though\\nit is a user MR. This causes function mlx5_free_priv_descs() to think that\\nit is a kernel MR, leading to wrongly accessing mr-\u003edescs that will get\\nwrong values in the union which leads to attempt to release resources that\\nwere not allocated in the first place.\\n\\nFor example:\\n DMA-API: mlx5_core 0000:08:00.1: device driver tries to free DMA memory it has not allocated [device address=0x0000000000000000] [size=0 bytes]\\n WARNING: CPU: 8 PID: 1021 at kernel/dma/debug.c:961 check_unmap+0x54f/0x8b0\\n RIP: 0010:check_unmap+0x54f/0x8b0\\n Call Trace:\\n  debug_dma_unmap_page+0x57/0x60\\n  mlx5_free_priv_descs+0x57/0x70 [mlx5_ib]\\n  mlx5_ib_dereg_mr+0x1fb/0x3d0 [mlx5_ib]\\n  ib_dereg_mr_user+0x60/0x140 [ib_core]\\n  uverbs_destroy_uobject+0x59/0x210 [ib_uverbs]\\n  uobj_destroy+0x3f/0x80 [ib_uverbs]\\n  ib_uverbs_cmd_verbs+0x435/0xd10 [ib_uverbs]\\n  ? uverbs_finalize_object+0x50/0x50 [ib_uverbs]\\n  ? lock_acquire+0xc4/0x2e0\\n  ? lock_acquired+0x12/0x380\\n  ? lock_acquire+0xc4/0x2e0\\n  ? lock_acquire+0xc4/0x2e0\\n  ? ib_uverbs_ioctl+0x7c/0x140 [ib_uverbs]\\n  ? lock_release+0x28a/0x400\\n  ib_uverbs_ioctl+0xc0/0x140 [ib_uverbs]\\n  ? ib_uverbs_ioctl+0x7c/0x140 [ib_uverbs]\\n  __x64_sys_ioctl+0x7f/0xb0\\n  do_syscall_64+0x38/0x90\\n\\nFix it by reorganizing the dereg flow and mlx5_ib_mr structure:\\n - Move the ib_umem field into the user MRs structure in the union as it\u0027s\\n   applicable only there.\\n - Function mlx5_ib_dereg_mr() will now call mlx5_free_priv_descs() only\\n   in case there isn\u0027t udata, which indicates that this isn\u0027t a user MR.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: RDMA/mlx5: Se corrigi\u00f3 la liberaci\u00f3n de memoria no asignada en el flujo de MR dereg. Para el caso de IB_MR_TYPE_DM, mr no tiene un umem, aunque sea un usuario MR. Esto hace que la funci\u00f3n mlx5_free_priv_descs() piense que es un MR del kernel, lo que lleva a un acceso incorrecto a mr-\u0026gt;descs que obtendr\u00e1 valores incorrectos en la uni\u00f3n, lo que lleva a intentar liberar recursos que no fueron asignados en primer lugar. Por ejemplo: DMA-API: mlx5_core 0000:08:00.1: el controlador de dispositivo intenta liberar la memoria DMA que no ha asignado [direcci\u00f3n del dispositivo=0x0000000000000000] [tama\u00f1o=0 bytes] ADVERTENCIA: CPU: 8 PID: 1021 en kernel/dma/ debug.c:961 check_unmap+0x54f/0x8b0 RIP: 0010:check_unmap+0x54f/0x8b0 Seguimiento de llamadas: debug_dma_unmap_page+0x57/0x60 mlx5_free_priv_descs+0x57/0x70 [mlx5_ib] [mlx5_ib] ib_dereg_mr_user+0x60/0x140 [ib_core ] uverbs_destroy_uobject+0x59/0x210 [ib_uverbs] uobj_destroy+0x3f/0x80 [ib_uverbs] ib_uverbs_cmd_verbs+0x435/0xd10 [ib_uverbs] ? uverbs_finalize_object+0x50/0x50 [ib_uverbs] ? lock_acquire+0xc4/0x2e0? lock_adquirido+0x12/0x380? lock_acquire+0xc4/0x2e0? lock_acquire+0xc4/0x2e0? ib_uverbs_ioctl+0x7c/0x140 [ib_uverbs] ? lock_release+0x28a/0x400 ib_uverbs_ioctl+0xc0/0x140 [ib_uverbs]? ib_uverbs_ioctl+0x7c/0x140 [ib_uverbs] __x64_sys_ioctl+0x7f/0xb0 do_syscall_64+0x38/0x90 Soluci\u00f3nelo reorganizando el flujo de dereg y la estructura mlx5_ib_mr: - Mueva el campo ib_umem a la estructura MRs del usuario en la uni\u00f3n, ya que solo se aplica all\u00ed. - La funci\u00f3n mlx5_ib_dereg_mr() ahora llamar\u00e1 a mlx5_free_priv_descs() solo en caso de que no haya udata, lo que indica que no se trata de un usuario MR.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/c44979ace49b4aede3cc7cb5542316e53a4005c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e3bc4d4b50cae7db08e50dbe43f771c906e97701\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0ae4afe3d35e67db042c58a52909e06262b740f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.