In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Do not register event handler until srpt device is fully setup
Upon rare occasions, KASAN reports a use-after-free Write in srptrefreshport().
This seems to be because an event handler is registered before the srpt device is fully setup and a race condition upon error may leave a partially setup event handler in place.
Instead, only register the event handler after srpt device initialization is complete.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"216845969773303264557451292945757097100",
"316255806319722061017807766364545414436",
"330698749381296529829076275398671756847",
"191221581860536188339010992947296296354",
"141109050499378542313076764882463606397",
"80489961880921036357875773195879376181",
"257686683112536052258091578975305783620",
"142642476406193814444789845947195979537",
"227554717230318759033081715591497444014",
"194357610432967806056524184998205485063",
"192544056164158711247100556802072260464"
]
},
"id": "CVE-2024-26872-12fd9a63",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6413e78086caf7bf15639923740da0d91fdfd090",
"target": {
"file": "drivers/infiniband/ulp/srpt/ib_srpt.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "86090659329707729259422358347701063857",
"length": 2704.0
},
"id": "CVE-2024-26872-1b73eb31",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e362d007294955a4fb929e1c8978154a64efdcb6",
"target": {
"file": "drivers/infiniband/ulp/srpt/ib_srpt.c",
"function": "srpt_add_one"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "86090659329707729259422358347701063857",
"length": 2704.0
},
"id": "CVE-2024-26872-344992b8",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec77fa12da41260c6bf9e060b89234b980c5130f",
"target": {
"file": "drivers/infiniband/ulp/srpt/ib_srpt.c",
"function": "srpt_add_one"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"216845969773303264557451292945757097100",
"316255806319722061017807766364545414436",
"330698749381296529829076275398671756847",
"191221581860536188339010992947296296354",
"141109050499378542313076764882463606397",
"80489961880921036357875773195879376181",
"257686683112536052258091578975305783620",
"142642476406193814444789845947195979537",
"227554717230318759033081715591497444014",
"194357610432967806056524184998205485063",
"192544056164158711247100556802072260464"
]
},
"id": "CVE-2024-26872-666db038",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e362d007294955a4fb929e1c8978154a64efdcb6",
"target": {
"file": "drivers/infiniband/ulp/srpt/ib_srpt.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "164487913212308982625559599481303548169",
"length": 2708.0
},
"id": "CVE-2024-26872-7925e8be",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6413e78086caf7bf15639923740da0d91fdfd090",
"target": {
"file": "drivers/infiniband/ulp/srpt/ib_srpt.c",
"function": "srpt_add_one"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"216845969773303264557451292945757097100",
"316255806319722061017807766364545414436",
"330698749381296529829076275398671756847",
"191221581860536188339010992947296296354",
"141109050499378542313076764882463606397",
"80489961880921036357875773195879376181",
"257686683112536052258091578975305783620",
"142642476406193814444789845947195979537",
"227554717230318759033081715591497444014",
"194357610432967806056524184998205485063",
"192544056164158711247100556802072260464"
]
},
"id": "CVE-2024-26872-a8e7d16e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec77fa12da41260c6bf9e060b89234b980c5130f",
"target": {
"file": "drivers/infiniband/ulp/srpt/ib_srpt.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"216845969773303264557451292945757097100",
"316255806319722061017807766364545414436",
"330698749381296529829076275398671756847",
"191221581860536188339010992947296296354",
"141109050499378542313076764882463606397",
"80489961880921036357875773195879376181",
"257686683112536052258091578975305783620",
"142642476406193814444789845947195979537",
"227554717230318759033081715591497444014",
"194357610432967806056524184998205485063",
"192544056164158711247100556802072260464"
]
},
"id": "CVE-2024-26872-b38b7770",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85570b91e4820a0db9d9432098778cafafa7d217",
"target": {
"file": "drivers/infiniband/ulp/srpt/ib_srpt.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "86090659329707729259422358347701063857",
"length": 2704.0
},
"id": "CVE-2024-26872-d4cfa609",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85570b91e4820a0db9d9432098778cafafa7d217",
"target": {
"file": "drivers/infiniband/ulp/srpt/ib_srpt.c",
"function": "srpt_add_one"
}
}
]