PT-2024-11155 · Linux+2 · Linux Kernel+2

Syzbot · Published 2021-05-11 · Updated 2024-11-01 · CVE-2021-47078

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.12.0-syzkaller

Description The issue is related to the RDMA/rxe component of the Linux kernel. Specifically, the rxe qp do cleanup() function relies on valid pointer values in the QP (Queue Pair) for properly created ones. However, if rxe qp from init() fails, it fills the QP with garbage, leading to a refcount t underflow and use-after-free error. This vulnerability can cause a system crash or potentially allow an attacker to execute arbitrary code.

Recommendations To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability. Ensure that all systems using the affected kernel versions are updated as soon as possible to prevent potential exploitation. Additionally, consider implementing security measures such as memory protection and access control to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-07274

CVE-2021-47078

OESA-2024-1483

OESA-2024-1484

OPENSUSE-SU-2024_0857-1

SUSE-SU-2024:0856-1

SUSE-SU-2024:0857-1

SUSE-SU-2024:0925-1

SUSE-SU-2024:0926-1

SUSE-SU-2024:0975-1

SUSE-SU-2024:0976-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 256

• https://git.kernel.org/stable/c/67f29896fdc83298eed5a6576ff8f9873f709228 · Patch
• https://git.kernel.org/stable/c/6a8086a42dfbf548a42bf2ae4faa291645c72c66 · Patch
• https://osv.dev/vulnerability/OESA-2024-1483 · Vendor Advisory
• https://git.kernel.org/stable/c/03344e843ab6dd3b3f2cadfb65ed910590856c70 · Patch
• https://cve.org/CVERecord?id=CVE-2021-47078 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47171 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47180 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47143 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:0976-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47142 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47071 · Security Note
• https://git.kernel.org/stable/c/2ee4d79c364914989c80de382c0b1a7259a7e4b3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-52622 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47160 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47170 · Security Note