CVE-2021-47012 (GCVE-0-2021-47012)
Vulnerability from cvelistv5 – Published: 2024-02-28 08:13 – Updated: 2026-08-05 08:45
VLAI
EPSS
VEX
Title
RDMA/siw: Fix a use after free in siw_alloc_mr
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix a use after free in siw_alloc_mr
Our code analyzer reported a UAF.
In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of
siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via
kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a
freed object. After, the execution continue up to the err_out branch of
siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr).
My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {}
section, to avoid the uaf.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-28 20:34 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
2251334dcac9eb337575d8767e2a6a7e81848f7f , < 30b9e92d0b5e5d5dc1101ab856c17009537cbca4
(git)
Affected: 2251334dcac9eb337575d8767e2a6a7e81848f7f , < 608a4b90ece039940e9425ee2b39c8beff27e00c (git) Affected: 2251334dcac9eb337575d8767e2a6a7e81848f7f , < 3e22b88e02c194f6c80867abfef5cc09383461f4 (git) Affected: 2251334dcac9eb337575d8767e2a6a7e81848f7f , < ad9ce7188432650469a6c7625bf479f5ed0b6155 (git) Affected: 2251334dcac9eb337575d8767e2a6a7e81848f7f , < 3093ee182f01689b89e9f8797b321603e5de4f63 (git) |
guessed | |
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 5.4.119 , ≤ 5.4.* (semver) Unaffected: 5.10.37 , ≤ 5.10.* (semver) Unaffected: 5.11.21 , ≤ 5.11.* (semver) Unaffected: 5.12.4 , ≤ 5.12.* (semver) Unaffected: 5.13 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47012",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-28T20:34:17.324799Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:13:27.028Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:24:39.841Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/30b9e92d0b5e5d5dc1101ab856c17009537cbca4"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/608a4b90ece039940e9425ee2b39c8beff27e00c"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/3e22b88e02c194f6c80867abfef5cc09383461f4"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/ad9ce7188432650469a6c7625bf479f5ed0b6155"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/3093ee182f01689b89e9f8797b321603e5de4f63"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "30b9e92d0b5e5d5dc1101ab856c17009537cbca4",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
},
{
"lessThan": "608a4b90ece039940e9425ee2b39c8beff27e00c",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
},
{
"lessThan": "3e22b88e02c194f6c80867abfef5cc09383461f4",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
},
{
"lessThan": "ad9ce7188432650469a6c7625bf479f5ed0b6155",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
},
{
"lessThan": "3093ee182f01689b89e9f8797b321603e5de4f63",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.119",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.11.*",
"status": "unaffected",
"version": "5.11.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.12.*",
"status": "unaffected",
"version": "5.12.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.119",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.37",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.21",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.12.4",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.13",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix a use after free in siw_alloc_mr\n\nOur code analyzer reported a UAF.\n\nIn siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of\nsiw_mr_add_mem(), mem is assigned to mr-\u003emem and then mem is freed via\nkfree(mem) if xa_alloc_cyclic() failed. Here, mr-\u003emem still point to a\nfreed object. After, the execution continue up to the err_out branch of\nsiw_alloc_mr, and the freed mr-\u003emem is used in siw_mr_drop_mem(mr).\n\nMy patch moves \"mr-\u003emem = mem\" behind the if (xa_alloc_cyclic(..)\u003c0) {}\nsection, to avoid the uaf."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached via local RDMA verbs (REG_MR/alloc_mr) through /dev/infiniband/uverbs*, not by processing remote iWARP packets; a local process must issue the memory-registration syscall path.\nAC:L - An unprivileged attacker can reliably drive xa_alloc_cyclic() failure via memory pressure (GFP_KERNEL), then hit the deterministic UAF/double-free on the err_out path with no race outside their control.\nPR:L - uverbs nodes are created mode 0666 and REG_MR requires no capability; once a SIW device exists, a normal local user can open it and trigger the vulnerable path.\nUI:N - Exploitation needs no victim action beyond the attacker\u2019s own verbs calls on an already-available SIW device.\nS:U - Impact is confined to the local kernel privilege boundary (standard local heap corruption/privilege escalation), with no VM/IOMMU/sandbox escape.\nC:H - Use-after-free of the siw_mem object enables heap reuse and arbitrary kernel memory read primitives per UAF exploitation.\nI:H - The err_out path performs UAF writes and a secondary free via siw_mem_put, yielding classic heap corruption suitable for arbitrary write/control-flow hijack.\nA:H - The UAF/double-free reliably causes kernel oops/panic (and WARN_ON in xa_erase) even without full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:45:33.281Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/30b9e92d0b5e5d5dc1101ab856c17009537cbca4"
},
{
"url": "https://git.kernel.org/stable/c/608a4b90ece039940e9425ee2b39c8beff27e00c"
},
{
"url": "https://git.kernel.org/stable/c/3e22b88e02c194f6c80867abfef5cc09383461f4"
},
{
"url": "https://git.kernel.org/stable/c/ad9ce7188432650469a6c7625bf479f5ed0b6155"
},
{
"url": "https://git.kernel.org/stable/c/3093ee182f01689b89e9f8797b321603e5de4f63"
}
],
"title": "RDMA/siw: Fix a use after free in siw_alloc_mr",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47012",
"datePublished": "2024-02-28T08:13:30.284Z",
"dateReserved": "2024-02-27T18:42:55.953Z",
"dateUpdated": "2026-08-05T08:45:33.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-47012",
"date": "2026-10-21",
"epss": "0.0027",
"percentile": "0.18219"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "30b9e92d0b5e5d5dc1101ab856c17009537cbca4",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
},
{
"lessThan": "608a4b90ece039940e9425ee2b39c8beff27e00c",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
},
{
"lessThan": "3e22b88e02c194f6c80867abfef5cc09383461f4",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
},
{
"lessThan": "ad9ce7188432650469a6c7625bf479f5ed0b6155",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
},
{
"lessThan": "3093ee182f01689b89e9f8797b321603e5de4f63",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.119",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.11.*",
"status": "unaffected",
"version": "5.11.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.12.*",
"status": "unaffected",
"version": "5.12.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2196F00F-D829-48E9-87B7-31759423D345",
"versionEndExcluding": "5.4.119",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7A4CF5D6-ACBA-4980-ABFD-3D7A53B5BB4E",
"versionEndExcluding": "5.10.37",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8CBB94EC-EC33-4464-99C5-03E5542715F0",
"versionEndExcluding": "5.11.21",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D8C7052F-1B7B-4327-9C2B-84EBF3243838",
"versionEndExcluding": "5.12.4",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix a use after free in siw_alloc_mr\n\nOur code analyzer reported a UAF.\n\nIn siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of\nsiw_mr_add_mem(), mem is assigned to mr-\u003emem and then mem is freed via\nkfree(mem) if xa_alloc_cyclic() failed. Here, mr-\u003emem still point to a\nfreed object. After, the execution continue up to the err_out branch of\nsiw_alloc_mr, and the freed mr-\u003emem is used in siw_mr_drop_mem(mr).\n\nMy patch moves \"mr-\u003emem = mem\" behind the if (xa_alloc_cyclic(..)\u003c0) {}\nsection, to avoid the uaf."
},
{
"lang": "es",
"value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: RDMA/siw: Corrige un use after free en siw_alloc_mr Nuestro analizador de c\u00f3digo inform\u00f3 un UAF. En siw_alloc_mr(), llama a siw_mr_add_mem(mr,..). En la implementaci\u00f3n de siw_mr_add_mem(), mem se asigna a mr-\u0026gt;mem y luego mem se libera mediante kfree(mem) si xa_alloc_ciclic() falla. Aqu\u00ed, mr-\u0026gt;mem todav\u00eda apunta a un objeto liberado. Despu\u00e9s, la ejecuci\u00f3n contin\u00faa hasta la rama err_out de siw_alloc_mr, y el mr-\u0026gt;mem liberado se usa en siw_mr_drop_mem(mr). Mi parche mueve \"mr-\u0026gt;mem = mem\" detr\u00e1s de la secci\u00f3n if (xa_alloc_ciclic(..)\u0026lt;0) {}, para evitar el uaf."
}
],
"id": "CVE-2021-47012",
"lastModified": "2026-08-04T10:16:41.407",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2021-47012",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-28T20:34:17.324799Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-02-28T09:15:38.753",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/3093ee182f01689b89e9f8797b321603e5de4f63"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/30b9e92d0b5e5d5dc1101ab856c17009537cbca4"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/3e22b88e02c194f6c80867abfef5cc09383461f4"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/608a4b90ece039940e9425ee2b39c8beff27e00c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/ad9ce7188432650469a6c7625bf479f5ed0b6155"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/3093ee182f01689b89e9f8797b321603e5de4f63"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/30b9e92d0b5e5d5dc1101ab856c17009537cbca4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/3e22b88e02c194f6c80867abfef5cc09383461f4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/608a4b90ece039940e9425ee2b39c8beff27e00c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/ad9ce7188432650469a6c7625bf479f5ed0b6155"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T20:09:41+00:00",
"cve": "CVE-2021-47012",
"id": "CVE-2021-47012",
"initial_release_date": "2021-01-01T00:00:00+00:00",
"product_status:known_affected": "90",
"product_status:known_not_affected": "108",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: RDMA/siw: Fix a use after free in siw_alloc_mr",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47012.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:24:39.841Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/30b9e92d0b5e5d5dc1101ab856c17009537cbca4"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/608a4b90ece039940e9425ee2b39c8beff27e00c"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/3e22b88e02c194f6c80867abfef5cc09383461f4"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/ad9ce7188432650469a6c7625bf479f5ed0b6155"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/3093ee182f01689b89e9f8797b321603e5de4f63"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47012",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-28T20:34:17.324799Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-05-23T19:01:13.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "30b9e92d0b5e5d5dc1101ab856c17009537cbca4",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
},
{
"lessThan": "608a4b90ece039940e9425ee2b39c8beff27e00c",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
},
{
"lessThan": "3e22b88e02c194f6c80867abfef5cc09383461f4",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
},
{
"lessThan": "ad9ce7188432650469a6c7625bf479f5ed0b6155",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
},
{
"lessThan": "3093ee182f01689b89e9f8797b321603e5de4f63",
"status": "affected",
"version": "2251334dcac9eb337575d8767e2a6a7e81848f7f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.119",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.11.*",
"status": "unaffected",
"version": "5.11.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.12.*",
"status": "unaffected",
"version": "5.12.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.119",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.37",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.21",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.12.4",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.13",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix a use after free in siw_alloc_mr\n\nOur code analyzer reported a UAF.\n\nIn siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of\nsiw_mr_add_mem(), mem is assigned to mr-\u003emem and then mem is freed via\nkfree(mem) if xa_alloc_cyclic() failed. Here, mr-\u003emem still point to a\nfreed object. After, the execution continue up to the err_out branch of\nsiw_alloc_mr, and the freed mr-\u003emem is used in siw_mr_drop_mem(mr).\n\nMy patch moves \"mr-\u003emem = mem\" behind the if (xa_alloc_cyclic(..)\u003c0) {}\nsection, to avoid the uaf."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached via local RDMA verbs (REG_MR/alloc_mr) through /dev/infiniband/uverbs*, not by processing remote iWARP packets; a local process must issue the memory-registration syscall path.\nAC:L - An unprivileged attacker can reliably drive xa_alloc_cyclic() failure via memory pressure (GFP_KERNEL), then hit the deterministic UAF/double-free on the err_out path with no race outside their control.\nPR:L - uverbs nodes are created mode 0666 and REG_MR requires no capability; once a SIW device exists, a normal local user can open it and trigger the vulnerable path.\nUI:N - Exploitation needs no victim action beyond the attacker\u2019s own verbs calls on an already-available SIW device.\nS:U - Impact is confined to the local kernel privilege boundary (standard local heap corruption/privilege escalation), with no VM/IOMMU/sandbox escape.\nC:H - Use-after-free of the siw_mem object enables heap reuse and arbitrary kernel memory read primitives per UAF exploitation.\nI:H - The err_out path performs UAF writes and a secondary free via siw_mem_put, yielding classic heap corruption suitable for arbitrary write/control-flow hijack.\nA:H - The UAF/double-free reliably causes kernel oops/panic (and WARN_ON in xa_erase) even without full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:45:33.281Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/30b9e92d0b5e5d5dc1101ab856c17009537cbca4"
},
{
"url": "https://git.kernel.org/stable/c/608a4b90ece039940e9425ee2b39c8beff27e00c"
},
{
"url": "https://git.kernel.org/stable/c/3e22b88e02c194f6c80867abfef5cc09383461f4"
},
{
"url": "https://git.kernel.org/stable/c/ad9ce7188432650469a6c7625bf479f5ed0b6155"
},
{
"url": "https://git.kernel.org/stable/c/3093ee182f01689b89e9f8797b321603e5de4f63"
}
],
"title": "RDMA/siw: Fix a use after free in siw_alloc_mr",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47012",
"datePublished": "2024-02-28T08:13:30.284Z",
"dateReserved": "2024-02-27T18:42:55.953Z",
"dateUpdated": "2026-08-05T08:45:33.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.