IB/mlx5: Fix initializing CQ fragments buffer (Linux Linux)

CVE-2021-47261
HIGH 7.8

At a glance

Source
NVD
EPSS
EPSS 0.24 % · percentile 15 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Modified

Description

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix initializing CQ fragments buffer The function init_cq_frag_buf() can be called to initialize the current CQ fragments buffer cq->buf, or the temporary cq->resize_buf that is filled during CQ resize operation. However, the offending commit started to use function get_cqe() for getting the CQEs, the issue with this change is that get_cqe() always returns CQEs from cq->buf, which leads us to initialize the wrong buffer, and in case of enlarging the CQ we try to access elements beyond the size of the current cq->buf and eventually hit a kernel panic. [exception RIP: init_cq_frag_buf+103] [ffff9f799ddcbcd8] mlx5_ib_resize_cq at ffffffffc0835d60 [mlx5_ib] [ffff9f799ddcbdb0] ib_resize_cq at ffffffffc05270df [ib_core] [ffff9f799ddcbdc0] llt_rdma_setup_qp at ffffffffc0a6a712 [llt] [ffff9f799ddcbe10] llt_rdma_cc_event_action at ffffffffc0a6b411 [llt] [ffff9f799ddcbe98] llt_rdma_client_conn_thread at ffffffffc0a6bb75 [llt] [ffff9f799ddcbec8] kthread at ffffffffa66c5da1 [ffff9f799ddcbf50] ret_from_fork_nospec_begin at ffffffffa6d95ddd Fix it by getting the needed CQE by calling mlx5_frag_buf_get_wqe() that takes the correct source buffer as a parameter.

Weaknesses (CWE)

  • CWE-706 — Use of Incorrectly-Resolved Name or Reference

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected 388ca8be00370db132464e27f745b8a0add19fcb < 1ec2dcd680c71d0d36fa25638b327a468babd5c9 ; affected 388ca8be00370db132464e27f745b8a0add19fcb < e3ecd9c09fcc10cf6b2bc67e2990c397c40a8c26 ; affected 388ca8be00370db132464e27f745b8a0add19fcb < 91f7fdc4cc10542ca1045c06aad23365f0d067e0 ; affected 388ca8be00370db132464e27f745b8a0add19fcb < 3e670c54eda238cb8a1ea93538a79ae89285c1c4 ; affected 388ca8be00370db132464e27f745b8a0add19fcb < 2ba0aa2feebda680ecfc3c552e867cf4d1b05a3a
Linux · Linuxaffected 4.17 ; unaffected 0 < 4.17 ; unaffected 4.19.195 ≤ 4.19.* ; unaffected 5.4.126 ≤ 5.4.* ; unaffected 5.10.44 ≤ 5.10.* ; unaffected 5.12.11 ≤ 5.12.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD