In the Linux kernel, the following vulnerability has been resolved:
RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
iwconnreqhandler() associates a new struct rdmaidprivate (connid) with an existing struct iwcmid (cm_id) as follows:
conn_id->cm_id.iw = cm_id;
cm_id->context = conn_id;
cm_id->cm_handler = cma_iw_handler;
rdmadestroyid() frees both the cmid and the struct rdmaidprivate. Make sure that cmworkhandler() does not trigger a use-after-free by only freeing of the struct rdmaid_private after all pending work has finished.
[
{
"digest": {
"length": 1413.0,
"function_hash": "55480966054796319938963977917529793275"
},
"target": {
"function": "destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@557d035fe88d78dd51664f4dc0e1896c04c97cf6",
"id": "CVE-2024-42285-0009ada1",
"signature_type": "Function"
},
{
"digest": {
"length": 837.0,
"function_hash": "120165040966935595623765248429745493808"
},
"target": {
"function": "cm_work_handler",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc8074b8901caabb97c2d353abd6b4e7fa5a59a5",
"id": "CVE-2024-42285-06e939c1",
"signature_type": "Function"
},
{
"digest": {
"length": 1413.0,
"function_hash": "55480966054796319938963977917529793275"
},
"target": {
"function": "destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee39384ee787e86e9db4efb843818ef0ea9cb8ae",
"id": "CVE-2024-42285-0f426bb6",
"signature_type": "Function"
},
{
"digest": {
"length": 837.0,
"function_hash": "120165040966935595623765248429745493808"
},
"target": {
"function": "cm_work_handler",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d91d253c87fd1efece521ff2612078a35af673c6",
"id": "CVE-2024-42285-14520f4c",
"signature_type": "Function"
},
{
"digest": {
"length": 1413.0,
"function_hash": "55480966054796319938963977917529793275"
},
"target": {
"function": "destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff5bbbdee08287d75d72e65b72a2b76d9637892a",
"id": "CVE-2024-42285-27a0f9d5",
"signature_type": "Function"
},
{
"digest": {
"length": 837.0,
"function_hash": "120165040966935595623765248429745493808"
},
"target": {
"function": "cm_work_handler",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94ee7ff99b87435ec63211f632918dc7f44dac79",
"id": "CVE-2024-42285-30a2aed2",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"136894789125940577010438558893496324958",
"229334870779356957511159410742499093150",
"288224406933043074175130108408823811199",
"283983184310495469848946994538465080246",
"126567275135990078006145955402627425383",
"249406356433322041924340107134232204744",
"282991117659040015285811961079537482924",
"234379187052068219897698326305831049672",
"326381050345400439972919408561223572518",
"228416337949452897230157496188965746107",
"14095222751354742728661920785572204260",
"239534581654009137715654672943954604276",
"201544129461597200956963440664221752226",
"7093576389627831214893222433359455104",
"238236116513545798389868790721532161687",
"102482944283378760898454523281561878047"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f25f296fc9bd0435be14e89bf657cd615a23574",
"id": "CVE-2024-42285-402de5ec",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"136894789125940577010438558893496324958",
"229334870779356957511159410742499093150",
"288224406933043074175130108408823811199",
"283983184310495469848946994538465080246",
"126567275135990078006145955402627425383",
"249406356433322041924340107134232204744",
"282991117659040015285811961079537482924",
"234379187052068219897698326305831049672",
"326381050345400439972919408561223572518",
"228416337949452897230157496188965746107",
"14095222751354742728661920785572204260",
"239534581654009137715654672943954604276",
"201544129461597200956963440664221752226",
"7093576389627831214893222433359455104",
"238236116513545798389868790721532161687",
"102482944283378760898454523281561878047"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff5bbbdee08287d75d72e65b72a2b76d9637892a",
"id": "CVE-2024-42285-41afbdab",
"signature_type": "Line"
},
{
"digest": {
"length": 57.0,
"function_hash": "253896680426164393151009864932457722232"
},
"target": {
"function": "iw_destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff5bbbdee08287d75d72e65b72a2b76d9637892a",
"id": "CVE-2024-42285-44f0f396",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"136894789125940577010438558893496324958",
"229334870779356957511159410742499093150",
"288224406933043074175130108408823811199",
"283983184310495469848946994538465080246",
"126567275135990078006145955402627425383",
"249406356433322041924340107134232204744",
"282991117659040015285811961079537482924",
"234379187052068219897698326305831049672",
"326381050345400439972919408561223572518",
"228416337949452897230157496188965746107",
"14095222751354742728661920785572204260",
"239534581654009137715654672943954604276",
"201544129461597200956963440664221752226",
"7093576389627831214893222433359455104",
"238236116513545798389868790721532161687",
"102482944283378760898454523281561878047"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aee2424246f9f1dadc33faa78990c1e2eb7826e4",
"id": "CVE-2024-42285-4a82e78f",
"signature_type": "Line"
},
{
"digest": {
"length": 57.0,
"function_hash": "253896680426164393151009864932457722232"
},
"target": {
"function": "iw_destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@557d035fe88d78dd51664f4dc0e1896c04c97cf6",
"id": "CVE-2024-42285-4e52d52f",
"signature_type": "Function"
},
{
"digest": {
"length": 837.0,
"function_hash": "120165040966935595623765248429745493808"
},
"target": {
"function": "cm_work_handler",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff5bbbdee08287d75d72e65b72a2b76d9637892a",
"id": "CVE-2024-42285-521bdb1c",
"signature_type": "Function"
},
{
"digest": {
"length": 57.0,
"function_hash": "253896680426164393151009864932457722232"
},
"target": {
"function": "iw_destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94ee7ff99b87435ec63211f632918dc7f44dac79",
"id": "CVE-2024-42285-76746c53",
"signature_type": "Function"
},
{
"digest": {
"length": 754.0,
"function_hash": "55622924646908308845772587014866558376"
},
"target": {
"function": "cm_work_handler",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aee2424246f9f1dadc33faa78990c1e2eb7826e4",
"id": "CVE-2024-42285-7b96dc1d",
"signature_type": "Function"
},
{
"digest": {
"length": 837.0,
"function_hash": "120165040966935595623765248429745493808"
},
"target": {
"function": "cm_work_handler",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee39384ee787e86e9db4efb843818ef0ea9cb8ae",
"id": "CVE-2024-42285-81be45ee",
"signature_type": "Function"
},
{
"digest": {
"length": 57.0,
"function_hash": "253896680426164393151009864932457722232"
},
"target": {
"function": "iw_destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f25f296fc9bd0435be14e89bf657cd615a23574",
"id": "CVE-2024-42285-892eea8c",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"136894789125940577010438558893496324958",
"229334870779356957511159410742499093150",
"288224406933043074175130108408823811199",
"283983184310495469848946994538465080246",
"126567275135990078006145955402627425383",
"249406356433322041924340107134232204744",
"282991117659040015285811961079537482924",
"234379187052068219897698326305831049672",
"326381050345400439972919408561223572518",
"228416337949452897230157496188965746107",
"14095222751354742728661920785572204260",
"239534581654009137715654672943954604276",
"201544129461597200956963440664221752226",
"7093576389627831214893222433359455104",
"238236116513545798389868790721532161687",
"102482944283378760898454523281561878047"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@557d035fe88d78dd51664f4dc0e1896c04c97cf6",
"id": "CVE-2024-42285-896234a6",
"signature_type": "Line"
},
{
"digest": {
"length": 57.0,
"function_hash": "253896680426164393151009864932457722232"
},
"target": {
"function": "iw_destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee39384ee787e86e9db4efb843818ef0ea9cb8ae",
"id": "CVE-2024-42285-90128af5",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"136894789125940577010438558893496324958",
"229334870779356957511159410742499093150",
"288224406933043074175130108408823811199",
"283983184310495469848946994538465080246",
"126567275135990078006145955402627425383",
"249406356433322041924340107134232204744",
"282991117659040015285811961079537482924",
"234379187052068219897698326305831049672",
"326381050345400439972919408561223572518",
"228416337949452897230157496188965746107",
"14095222751354742728661920785572204260",
"239534581654009137715654672943954604276",
"201544129461597200956963440664221752226",
"7093576389627831214893222433359455104",
"238236116513545798389868790721532161687",
"102482944283378760898454523281561878047"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc8074b8901caabb97c2d353abd6b4e7fa5a59a5",
"id": "CVE-2024-42285-942d035a",
"signature_type": "Line"
},
{
"digest": {
"length": 57.0,
"function_hash": "253896680426164393151009864932457722232"
},
"target": {
"function": "iw_destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aee2424246f9f1dadc33faa78990c1e2eb7826e4",
"id": "CVE-2024-42285-95eece22",
"signature_type": "Function"
},
{
"digest": {
"length": 837.0,
"function_hash": "120165040966935595623765248429745493808"
},
"target": {
"function": "cm_work_handler",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@557d035fe88d78dd51664f4dc0e1896c04c97cf6",
"id": "CVE-2024-42285-9a4160b2",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"136894789125940577010438558893496324958",
"229334870779356957511159410742499093150",
"288224406933043074175130108408823811199",
"283983184310495469848946994538465080246",
"126567275135990078006145955402627425383",
"249406356433322041924340107134232204744",
"282991117659040015285811961079537482924",
"234379187052068219897698326305831049672",
"326381050345400439972919408561223572518",
"228416337949452897230157496188965746107",
"14095222751354742728661920785572204260",
"239534581654009137715654672943954604276",
"201544129461597200956963440664221752226",
"7093576389627831214893222433359455104",
"238236116513545798389868790721532161687",
"102482944283378760898454523281561878047"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94ee7ff99b87435ec63211f632918dc7f44dac79",
"id": "CVE-2024-42285-9ce9d3a4",
"signature_type": "Line"
},
{
"digest": {
"length": 57.0,
"function_hash": "253896680426164393151009864932457722232"
},
"target": {
"function": "iw_destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d91d253c87fd1efece521ff2612078a35af673c6",
"id": "CVE-2024-42285-aae3e70d",
"signature_type": "Function"
},
{
"digest": {
"length": 1413.0,
"function_hash": "55480966054796319938963977917529793275"
},
"target": {
"function": "destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94ee7ff99b87435ec63211f632918dc7f44dac79",
"id": "CVE-2024-42285-b8cbf2d7",
"signature_type": "Function"
},
{
"digest": {
"length": 1413.0,
"function_hash": "55480966054796319938963977917529793275"
},
"target": {
"function": "destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aee2424246f9f1dadc33faa78990c1e2eb7826e4",
"id": "CVE-2024-42285-bab28aec",
"signature_type": "Function"
},
{
"digest": {
"length": 1398.0,
"function_hash": "245817465736567903488796497530799453376"
},
"target": {
"function": "destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d91d253c87fd1efece521ff2612078a35af673c6",
"id": "CVE-2024-42285-c66aae98",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"136894789125940577010438558893496324958",
"229334870779356957511159410742499093150",
"288224406933043074175130108408823811199",
"283983184310495469848946994538465080246",
"126567275135990078006145955402627425383",
"249406356433322041924340107134232204744",
"282991117659040015285811961079537482924",
"234379187052068219897698326305831049672",
"326381050345400439972919408561223572518",
"228416337949452897230157496188965746107",
"14095222751354742728661920785572204260",
"239534581654009137715654672943954604276",
"201544129461597200956963440664221752226",
"7093576389627831214893222433359455104",
"238236116513545798389868790721532161687",
"102482944283378760898454523281561878047"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee39384ee787e86e9db4efb843818ef0ea9cb8ae",
"id": "CVE-2024-42285-ca538eee",
"signature_type": "Line"
},
{
"digest": {
"length": 1413.0,
"function_hash": "55480966054796319938963977917529793275"
},
"target": {
"function": "destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f25f296fc9bd0435be14e89bf657cd615a23574",
"id": "CVE-2024-42285-ccf7ddfb",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"136894789125940577010438558893496324958",
"229334870779356957511159410742499093150",
"288224406933043074175130108408823811199",
"315068283358369136840162018383608294789",
"126567275135990078006145955402627425383",
"249406356433322041924340107134232204744",
"282991117659040015285811961079537482924",
"234379187052068219897698326305831049672",
"326381050345400439972919408561223572518",
"228416337949452897230157496188965746107",
"14095222751354742728661920785572204260",
"239534581654009137715654672943954604276",
"201544129461597200956963440664221752226",
"7093576389627831214893222433359455104",
"238236116513545798389868790721532161687",
"102482944283378760898454523281561878047"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d91d253c87fd1efece521ff2612078a35af673c6",
"id": "CVE-2024-42285-dc472950",
"signature_type": "Line"
},
{
"digest": {
"length": 837.0,
"function_hash": "120165040966935595623765248429745493808"
},
"target": {
"function": "cm_work_handler",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f25f296fc9bd0435be14e89bf657cd615a23574",
"id": "CVE-2024-42285-dfe0252c",
"signature_type": "Function"
},
{
"digest": {
"length": 1413.0,
"function_hash": "55480966054796319938963977917529793275"
},
"target": {
"function": "destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc8074b8901caabb97c2d353abd6b4e7fa5a59a5",
"id": "CVE-2024-42285-e267e6f1",
"signature_type": "Function"
},
{
"digest": {
"length": 57.0,
"function_hash": "253896680426164393151009864932457722232"
},
"target": {
"function": "iw_destroy_cm_id",
"file": "drivers/infiniband/core/iwcm.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc8074b8901caabb97c2d353abd6b4e7fa5a59a5",
"id": "CVE-2024-42285-ff8a6085",
"signature_type": "Function"
}
]