PT-2021-8197 · Linux+4 · Linux Kernel+4

Dan Carpenter · Published 2021-12-07 · Updated 2024-12-04 · CVE-2021-47614

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a user-after-free vulnerability in the add pble prm function within the InfiniBand driver of the Linux kernel. This vulnerability occurs when the irdma hmc sd one function fails, causing a 'chunk' to be freed while still being referenced in the PBLE info list. The vulnerability can be exploited to impact the confidentiality, integrity, and availability of protected information. To mitigate this, the chunk entry should only be added to the PBLE info list after the successful setting of the SD in irdma hmc sd one.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2024-10599

CESA-2022_1975

CESA-2022_1988

CVE-2021-47614

OPENSUSE-SU-2024_2372-1

OPENSUSE-SU-2024_2394-1

RHSA-2022:1975

RHSA-2022:1988

RHSA-2022_1975

RHSA-2022_1988

SUSE-SU-2024:2372-1

SUSE-SU-2024:2394-1

SUSE-SU-2024:2902-1

SUSE-SU-2024:2929-1

SUSE-SU-2024:2939-1

Affected Products

Centos

Linux Kernel

Red Hat

Red Os

Suse

References · 1203

• https://osv.dev/vulnerability/SUSE-SU-2024:2939-1 · Vendor Advisory
• https://git.kernel.org/stable/c/1e11a39a82e95ce86f849f40dda0d9c0498cebd9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-47614 · Security Note
• https://ubuntu.com/security/CVE-2021-47614 · Vendor Advisory
• https://git.kernel.org/stable/c/11eebcf63e98fcf047a876a51d76afdabc3b8b9b · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:2929-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47614 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47614 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2372-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10599 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:2902-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-47614 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-47614 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:2394-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-47614 · Vendor Advisory