CVE-2024-47696

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-47696
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-47696.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-47696
Downstream
Related
Published
2024-10-21T11:53:33.950Z
Modified
2025-11-20T07:51:48.919567Z
Summary
RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
Details

In the Linux kernel, the following vulnerability has been resolved:

RDMA/iwcm: Fix WARNING:atkernel/workqueue.c:#checkflush_dependency

In the commit aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs"), the function flushworkqueue is invoked to flush the work queue iwcmwq.

But at that time, the work queue iwcmwq was created via the function allocorderedworkqueue without the flag WQMEM_RECLAIM.

Because the current process is trying to flush the whole iwcmwq, if iwcmwq doesn't have the flag WQMEMRECLAIM, verify that the current process is not reclaiming memory or running on a workqueue which doesn't have the flag WQMEMRECLAIM as that can break forward-progress guarantee leading to a deadlock.

The call trace is as below:

[ 125.350876][ T1430] Call Trace: [ 125.356281][ T1430] <TASK> [ 125.361285][ T1430] ? warn (kernel/panic.c:693) [ 125.367640][ T1430] ? checkflushdependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.375689][ T1430] ? reportbug (lib/bug.c:180 lib/bug.c:219) [ 125.382505][ T1430] ? handlebug (arch/x86/kernel/traps.c:239) [ 125.388987][ T1430] ? excinvalidop (arch/x86/kernel/traps.c:260 (discriminator 1)) [ 125.395831][ T1430] ? asmexcinvalidop (arch/x86/include/asm/idtentry.h:621) [ 125.403125][ T1430] ? checkflushdependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.410984][ T1430] ? checkflushdependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.418764][ T1430] _flushworkqueue (kernel/workqueue.c:3970) [ 125.426021][ T1430] ? _pfxmightresched (kernel/sched/core.c:10151) [ 125.433431][ T1430] ? destroycmid (drivers/infiniband/core/iwcm.c:375) iwcm [ 125.441209][ T1430] ? pfxflushworkqueue (kernel/workqueue.c:3910) [ 125.473900][ T1430] ? _rawspinlockirqsave (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlockapismp.h:111 kernel/locking/spinlock.c:162) [ 125.473909][ T1430] ? pfxrawspinlockirqsave (kernel/locking/spinlock.c:161) [ 125.482537][ T1430] _destroyid (drivers/infiniband/core/cma.c:2044) rdmacm [ 125.495072][ T1430] nvmerdmafreequeue (drivers/nvme/host/rdma.c:656 drivers/nvme/host/rdma.c:650) nvmerdma [ 125.505827][ T1430] nvmerdmaresetctrlwork (drivers/nvme/host/rdma.c:2180) nvmerdma [ 125.505831][ T1430] processonework (kernel/workqueue.c:3231) [ 125.515122][ T1430] workerthread (kernel/workqueue.c:3306 kernel/workqueue.c:3393) [ 125.515127][ T1430] ? _pfxworkerthread (kernel/workqueue.c:3339) [ 125.531837][ T1430] kthread (kernel/kthread.c:389) [ 125.539864][ T1430] ? _pfxkthread (kernel/kthread.c:342) [ 125.550628][ T1430] retfromfork (arch/x86/kernel/process.c:147) [ 125.558840][ T1430] ? _pfxkthread (kernel/kthread.c:342) [ 125.558844][ T1430] retfromforkasm (arch/x86/entry/entry64.S:257) [ 125.566487][ T1430] </TASK> [ 125.566488][ T1430] ---[ end trace 0000000000000000 ]---

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d91d253c87fd1efece521ff2612078a35af673c6
Fixed
da2708a19f45b4a7278adf523837c8db21d1e2b5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
7f25f296fc9bd0435be14e89bf657cd615a23574
Fixed
29b3bbd912b8db86df7a3c180b910ccb621f5635
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
94ee7ff99b87435ec63211f632918dc7f44dac79
Fixed
2efe8da2ddbf873385b4bc55366d09350b408df6
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
557d035fe88d78dd51664f4dc0e1896c04c97cf6
Fixed
da0392698c62397c19deb1b9e9bdf2fbb5a9420e
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
dc8074b8901caabb97c2d353abd6b4e7fa5a59a5
Fixed
a64f30db12bdc937c5108158d98c8eab1925c548
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ff5bbbdee08287d75d72e65b72a2b76d9637892a
Fixed
8b7df76356d098f85f3bd2c7cf6fb43f531893d7
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ee39384ee787e86e9db4efb843818ef0ea9cb8ae
Fixed
c8b18a75282cfd27822a8cc3c1f005c1ac8d1a58
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
aee2424246f9f1dadc33faa78990c1e2eb7826e4
Fixed
a09dc967b3c58899e259c0aea092f421d22a0b04
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
aee2424246f9f1dadc33faa78990c1e2eb7826e4
Fixed
86dfdd8288907f03c18b7fb462e0e232c4f98d89

Affected versions

v4.*

v4.19.320
v4.19.321
v4.19.322

v5.*

v5.10.224
v5.10.225
v5.10.226
v5.15.165
v5.15.166
v5.15.167
v5.4.282
v5.4.283
v5.4.284

v6.*

v6.1.103
v6.1.104
v6.1.105
v6.1.106
v6.1.107
v6.1.108
v6.1.109
v6.1.110
v6.1.111
v6.1.112
v6.10
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.10.10
v6.10.11
v6.10.12
v6.10.3
v6.10.4
v6.10.5
v6.10.6
v6.10.7
v6.10.8
v6.10.9
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.11.1
v6.6.44
v6.6.45
v6.6.46
v6.6.47
v6.6.48
v6.6.49
v6.6.50
v6.6.51
v6.6.52
v6.6.53

Database specific

vanir_signatures

[
    {
        "id": "CVE-2024-47696-00d0303f",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "54500722442076768755284512596928000165",
                "294169970546329670900183153713986114792",
                "11242760305164786738219260277020041836",
                "179600910527671678831976827448530630262"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da0392698c62397c19deb1b9e9bdf2fbb5a9420e",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c"
        }
    },
    {
        "id": "CVE-2024-47696-059a81c6",
        "signature_version": "v1",
        "digest": {
            "function_hash": "53645084047679020475321507493692767774",
            "length": 516.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a09dc967b3c58899e259c0aea092f421d22a0b04",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c",
            "function": "iw_cm_init"
        }
    },
    {
        "id": "CVE-2024-47696-0679488b",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "54500722442076768755284512596928000165",
                "294169970546329670900183153713986114792",
                "11242760305164786738219260277020041836",
                "179600910527671678831976827448530630262"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86dfdd8288907f03c18b7fb462e0e232c4f98d89",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c"
        }
    },
    {
        "id": "CVE-2024-47696-15dc0e08",
        "signature_version": "v1",
        "digest": {
            "function_hash": "53645084047679020475321507493692767774",
            "length": 516.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da0392698c62397c19deb1b9e9bdf2fbb5a9420e",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c",
            "function": "iw_cm_init"
        }
    },
    {
        "id": "CVE-2024-47696-243aff5b",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "54500722442076768755284512596928000165",
                "294169970546329670900183153713986114792",
                "11242760305164786738219260277020041836",
                "179600910527671678831976827448530630262"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29b3bbd912b8db86df7a3c180b910ccb621f5635",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c"
        }
    },
    {
        "id": "CVE-2024-47696-25a392b8",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "54500722442076768755284512596928000165",
                "294169970546329670900183153713986114792",
                "11242760305164786738219260277020041836",
                "179600910527671678831976827448530630262"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b7df76356d098f85f3bd2c7cf6fb43f531893d7",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c"
        }
    },
    {
        "id": "CVE-2024-47696-2dd66365",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "54500722442076768755284512596928000165",
                "294169970546329670900183153713986114792",
                "11242760305164786738219260277020041836",
                "179600910527671678831976827448530630262"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2efe8da2ddbf873385b4bc55366d09350b408df6",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c"
        }
    },
    {
        "id": "CVE-2024-47696-2fb65b46",
        "signature_version": "v1",
        "digest": {
            "function_hash": "53645084047679020475321507493692767774",
            "length": 516.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86dfdd8288907f03c18b7fb462e0e232c4f98d89",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c",
            "function": "iw_cm_init"
        }
    },
    {
        "id": "CVE-2024-47696-31a71afd",
        "signature_version": "v1",
        "digest": {
            "function_hash": "53645084047679020475321507493692767774",
            "length": 516.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a64f30db12bdc937c5108158d98c8eab1925c548",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c",
            "function": "iw_cm_init"
        }
    },
    {
        "id": "CVE-2024-47696-370fc546",
        "signature_version": "v1",
        "digest": {
            "function_hash": "53645084047679020475321507493692767774",
            "length": 516.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2efe8da2ddbf873385b4bc55366d09350b408df6",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c",
            "function": "iw_cm_init"
        }
    },
    {
        "id": "CVE-2024-47696-4564a543",
        "signature_version": "v1",
        "digest": {
            "function_hash": "53645084047679020475321507493692767774",
            "length": 516.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29b3bbd912b8db86df7a3c180b910ccb621f5635",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c",
            "function": "iw_cm_init"
        }
    },
    {
        "id": "CVE-2024-47696-67164d75",
        "signature_version": "v1",
        "digest": {
            "function_hash": "53645084047679020475321507493692767774",
            "length": 516.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da2708a19f45b4a7278adf523837c8db21d1e2b5",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c",
            "function": "iw_cm_init"
        }
    },
    {
        "id": "CVE-2024-47696-6f39c315",
        "signature_version": "v1",
        "digest": {
            "function_hash": "53645084047679020475321507493692767774",
            "length": 516.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8b18a75282cfd27822a8cc3c1f005c1ac8d1a58",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c",
            "function": "iw_cm_init"
        }
    },
    {
        "id": "CVE-2024-47696-8f08d60d",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "54500722442076768755284512596928000165",
                "294169970546329670900183153713986114792",
                "11242760305164786738219260277020041836",
                "179600910527671678831976827448530630262"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8b18a75282cfd27822a8cc3c1f005c1ac8d1a58",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c"
        }
    },
    {
        "id": "CVE-2024-47696-964240a1",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "54500722442076768755284512596928000165",
                "294169970546329670900183153713986114792",
                "11242760305164786738219260277020041836",
                "179600910527671678831976827448530630262"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a64f30db12bdc937c5108158d98c8eab1925c548",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c"
        }
    },
    {
        "id": "CVE-2024-47696-ad72c086",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "54500722442076768755284512596928000165",
                "294169970546329670900183153713986114792",
                "11242760305164786738219260277020041836",
                "179600910527671678831976827448530630262"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da2708a19f45b4a7278adf523837c8db21d1e2b5",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c"
        }
    },
    {
        "id": "CVE-2024-47696-c70ee5aa",
        "signature_version": "v1",
        "digest": {
            "function_hash": "53645084047679020475321507493692767774",
            "length": 516.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b7df76356d098f85f3bd2c7cf6fb43f531893d7",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c",
            "function": "iw_cm_init"
        }
    },
    {
        "id": "CVE-2024-47696-e8363822",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "54500722442076768755284512596928000165",
                "294169970546329670900183153713986114792",
                "11242760305164786738219260277020041836",
                "179600910527671678831976827448530630262"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a09dc967b3c58899e259c0aea092f421d22a0b04",
        "target": {
            "file": "drivers/infiniband/core/iwcm.c"
        }
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.19.323
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.285
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.227
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.168
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.113
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.54
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.10.13
Type
ECOSYSTEM
Events
Introduced
6.11.0
Fixed
6.11.2