CVE-2024-42285

Severity CVSS v4.0:
Pending analysis
Type:
CWE-416 Use After Free
Publication date:
17/08/2024
Last modified:
19/08/2024

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/iwcm: Fix a use-after-free related to destroying CM IDs<br /> <br /> iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with<br /> an existing struct iw_cm_id (cm_id) as follows:<br /> <br /> conn_id-&gt;cm_id.iw = cm_id;<br /> cm_id-&gt;context = conn_id;<br /> cm_id-&gt;cm_handler = cma_iw_handler;<br /> <br /> rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make<br /> sure that cm_work_handler() does not trigger a use-after-free by only<br /> freeing of the struct rdma_id_private after all pending work has finished.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.8 (including) 4.19.320 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.20 (including) 5.4.282 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.224 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.165 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.103 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.44 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.10.3 (excluding)