Critical · published August 17, 2024
In the Linux kernel, the following vulnerability has been resolved:
RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with
an existing struct iw_cm_id (cm_id) as follows:
conn_id->cm_id.iw = cm_id;
cm_id->context = conn_id;
cm_id->cm_handler = cma_iw_handler;
rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make
sure that cm_work_handler() does not trigger a use-after-free by only
freeing of the struct rdma_id_private after all pending work has finished.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.8, < 4.19.320 | 4.19.320 |
| linux/linux_kernel | ≥ 4.20, < 5.4.282 | 5.4.282 |
| linux/linux_kernel | ≥ 5.5, < 5.10.224 | 5.10.224 |
| linux/linux_kernel | ≥ 5.11, < 5.15.165 | 5.15.165 |
| linux/linux_kernel | ≥ 5.16, < 6.1.103 | 6.1.103 |
| linux/linux_kernel | ≥ 6.2, < 6.6.44 | 6.6.44 |
| linux/linux_kernel | ≥ 6.7, < 6.10.3 | 6.10.3 |