CVE-2021-47261
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-47261
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47261.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-47261
- Related
- Published
- 2024-05-21T15:15:14Z
- Modified
- 2024-09-18T01:00:21Z
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
IB/mlx5: Fix initializing CQ fragments buffer
The function initcqfragbuf() can be called to initialize the current CQ fragments buffer cq->buf, or the temporary cq->resizebuf that is filled during CQ resize operation.
However, the offending commit started to use function getcqe() for getting the CQEs, the issue with this change is that getcqe() always returns CQEs from cq->buf, which leads us to initialize the wrong buffer, and in case of enlarging the CQ we try to access elements beyond the size of the current cq->buf and eventually hit a kernel panic.
[exception RIP: initcqfragbuf+103] [ffff9f799ddcbcd8] mlx5ibresizecq at ffffffffc0835d60 [mlx5ib] [ffff9f799ddcbdb0] ibresizecq at ffffffffc05270df [ibcore] [ffff9f799ddcbdc0] lltrdmasetupqp at ffffffffc0a6a712 [llt] [ffff9f799ddcbe10] lltrdmacceventaction at ffffffffc0a6b411 [llt] [ffff9f799ddcbe98] lltrdmaclientconnthread at ffffffffc0a6bb75 [llt] [ffff9f799ddcbec8] kthread at ffffffffa66c5da1 [ffff9f799ddcbf50] retfromforknospec_begin at ffffffffa6d95ddd
Fix it by getting the needed CQE by calling mlx5fragbufgetwqe() that takes the correct source buffer as a parameter.
- References
-
- https://git.kernel.org/stable/c/1ec2dcd680c71d0d36fa25638b327a468babd5c9
- https://git.kernel.org/stable/c/2ba0aa2feebda680ecfc3c552e867cf4d1b05a3a
- https://git.kernel.org/stable/c/3e670c54eda238cb8a1ea93538a79ae89285c1c4
- https://git.kernel.org/stable/c/91f7fdc4cc10542ca1045c06aad23365f0d067e0
- https://git.kernel.org/stable/c/e3ecd9c09fcc10cf6b2bc67e2990c397c40a8c26
- https://security-tracker.debian.org/tracker/CVE-2021-47261
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source