CVE-2024-38545 (GCVE-0-2024-38545)

Vulnerability from cvelistv5 – Published: 2024-06-19 13:35 – Updated: 2026-08-05 11:32
VLAI
Title
RDMA/hns: Fix UAF for cq async event
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix UAF for cq async event The refcount of CQ is not protected by locks. When CQ asynchronous events and CQ destruction are concurrent, CQ may have been released, which will cause UAF. Use the xa_lock() to protect the CQ refcount.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9a4435375cd151e07c0c38fa601b00115986091b , < 330c825e66ef65278e4ebe57fd49c1d6f3f4e34e (git)
Affected: 9a4435375cd151e07c0c38fa601b00115986091b , < 763780ef0336a973e933e40e919339381732dcaf (git)
Affected: 9a4435375cd151e07c0c38fa601b00115986091b , < 63da190eeb5c9d849b71f457b15b308c94cbaf08 (git)
Affected: 9a4435375cd151e07c0c38fa601b00115986091b , < 39d26cf46306bdc7ae809ecfdbfeff5aa1098911 (git)
Affected: 9a4435375cd151e07c0c38fa601b00115986091b , < 37a7559dc1358a8d300437e99ed8ecdab0671507 (git)
Affected: 9a4435375cd151e07c0c38fa601b00115986091b , < a942ec2745ca864cd8512142100e4027dc306a42 (git)
Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.93 , ≤ 6.1.* (semver)
Unaffected: 6.6.33 , ≤ 6.6.* (semver)
Unaffected: 6.8.12 , ≤ 6.8.* (semver)
Unaffected: 6.9.3 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.134Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/763780ef0336a973e933e40e919339381732dcaf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/63da190eeb5c9d849b71f457b15b308c94cbaf08"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/39d26cf46306bdc7ae809ecfdbfeff5aa1098911"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/37a7559dc1358a8d300437e99ed8ecdab0671507"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a942ec2745ca864cd8512142100e4027dc306a42"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38545",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:15:07.173513Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:57.896Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hns/hns_roce_cq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "330c825e66ef65278e4ebe57fd49c1d6f3f4e34e",
              "status": "affected",
              "version": "9a4435375cd151e07c0c38fa601b00115986091b",
              "versionType": "git"
            },
            {
              "lessThan": "763780ef0336a973e933e40e919339381732dcaf",
              "status": "affected",
              "version": "9a4435375cd151e07c0c38fa601b00115986091b",
              "versionType": "git"
            },
            {
              "lessThan": "63da190eeb5c9d849b71f457b15b308c94cbaf08",
              "status": "affected",
              "version": "9a4435375cd151e07c0c38fa601b00115986091b",
              "versionType": "git"
            },
            {
              "lessThan": "39d26cf46306bdc7ae809ecfdbfeff5aa1098911",
              "status": "affected",
              "version": "9a4435375cd151e07c0c38fa601b00115986091b",
              "versionType": "git"
            },
            {
              "lessThan": "37a7559dc1358a8d300437e99ed8ecdab0671507",
              "status": "affected",
              "version": "9a4435375cd151e07c0c38fa601b00115986091b",
              "versionType": "git"
            },
            {
              "lessThan": "a942ec2745ca864cd8512142100e4027dc306a42",
              "status": "affected",
              "version": "9a4435375cd151e07c0c38fa601b00115986091b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hns/hns_roce_cq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix UAF for cq async event\n\nThe refcount of CQ is not protected by locks. When CQ asynchronous\nevents and CQ destruction are concurrent, CQ may have been released,\nwhich will cause UAF.\n\nUse the xa_lock() to protect the CQ refcount."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to the RDMA user-verbs character device (/dev/infiniband/uverbs*) to create/destroy CQs and post work requests; although a remote RoCE peer can help generate the CQ async events, the destroy side of the race is a local ioctl/write command.\nAC:L - The attacker controls both sides of the race \u2014 generating CQ_OVERFLOW/CQ_ACCESS_ERROR async events via its own RDMA traffic while destroying the CQ from another thread \u2014 and the racing code runs in preemptible workqueue context, so the window is wide and the attempt can be repeated indefinitely.\nPR:L - No capability check exists on the uverbs CQ create/destroy path, and /dev/infiniband/uverbs* is world-accessible under standard rdma-core udev rules, so any unprivileged local user on an RDMA-capable host can reach it.\nUI:N - The attacker performs all steps itself \u2014 creating the CQ, generating the async events, and destroying the CQ concurrently \u2014 with no victim action required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed hns_roce_cq slab object is dereferenced after kfree(), and reclaiming it with attacker-controlled data plus the resulting indirect call yields arbitrary kernel-memory read capability.\nI:H - The stale pointer is both written through (refcount_inc on freed memory) and used for an indirect call \u2014 ibcq-\u003eevent_handler(\u0026event, ibcq-\u003ecq_context) with a function pointer and argument read from the freed object \u2014 giving control-flow hijack and arbitrary write potential.\nA:H - Even without successful heap grooming, the use-after-free corrupts the slab and jumps through a stale function pointer, reliably producing a kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:42.888Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/330c825e66ef65278e4ebe57fd49c1d6f3f4e34e"
        },
        {
          "url": "https://git.kernel.org/stable/c/763780ef0336a973e933e40e919339381732dcaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/63da190eeb5c9d849b71f457b15b308c94cbaf08"
        },
        {
          "url": "https://git.kernel.org/stable/c/39d26cf46306bdc7ae809ecfdbfeff5aa1098911"
        },
        {
          "url": "https://git.kernel.org/stable/c/37a7559dc1358a8d300437e99ed8ecdab0671507"
        },
        {
          "url": "https://git.kernel.org/stable/c/a942ec2745ca864cd8512142100e4027dc306a42"
        }
      ],
      "title": "RDMA/hns: Fix UAF for cq async event",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38545",
    "datePublished": "2024-06-19T13:35:19.336Z",
    "dateReserved": "2024-06-18T19:36:34.919Z",
    "dateUpdated": "2026-08-05T11:32:42.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-38545",
      "date": "2026-08-05",
      "epss": "0.00252",
      "percentile": "0.16546"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T15:15:09.000Z",
      "cve": "CVE-2024-38545",
      "id": "msrc_CVE-2024-38545",
      "initial_release_date": "2024-06-02T07:00:00.000Z",
      "product_status:fixed": "3",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/hns: Fix UAF for cq async event",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-38545.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38545\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T14:15:14.787\",\"lastModified\":\"2026-06-17T07:40:30.897\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/hns: Fix UAF for cq async event\\n\\nThe refcount of CQ is not protected by locks. When CQ asynchronous\\nevents and CQ destruction are concurrent, CQ may have been released,\\nwhich will cause UAF.\\n\\nUse the xa_lock() to protect the CQ refcount.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: RDMA/hns: corrige UAF para el evento cq async El recuento de CQ no est\u00e1 protegido por bloqueos. Cuando los eventos asincr\u00f3nicos de CQ y la destrucci\u00f3n de CQ son simult\u00e1neos, es posible que se haya liberado CQ, lo que provocar\u00e1 UAF. Utilice xa_lock() para proteger el recuento de CQ.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/hw/hns/hns_roce_cq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9a4435375cd151e07c0c38fa601b00115986091b\",\"lessThan\":\"330c825e66ef65278e4ebe57fd49c1d6f3f4e34e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a4435375cd151e07c0c38fa601b00115986091b\",\"lessThan\":\"763780ef0336a973e933e40e919339381732dcaf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a4435375cd151e07c0c38fa601b00115986091b\",\"lessThan\":\"63da190eeb5c9d849b71f457b15b308c94cbaf08\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a4435375cd151e07c0c38fa601b00115986091b\",\"lessThan\":\"39d26cf46306bdc7ae809ecfdbfeff5aa1098911\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a4435375cd151e07c0c38fa601b00115986091b\",\"lessThan\":\"37a7559dc1358a8d300437e99ed8ecdab0671507\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a4435375cd151e07c0c38fa601b00115986091b\",\"lessThan\":\"a942ec2745ca864cd8512142100e4027dc306a42\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/hw/hns/hns_roce_cq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.93\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.12\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.3\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:15:07.173513Z\",\"id\":\"CVE-2024-38545\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"B381E4E6-6765-4B5C-9F1F-CBF0872CC746\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.93\",\"matchCriteriaId\":\"EEFB78EE-F990-4197-BF1C-156760A55667\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.33\",\"matchCriteriaId\":\"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.12\",\"matchCriteriaId\":\"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.3\",\"matchCriteriaId\":\"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/330c825e66ef65278e4ebe57fd49c1d6f3f4e34e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/37a7559dc1358a8d300437e99ed8ecdab0671507\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/39d26cf46306bdc7ae809ecfdbfeff5aa1098911\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/63da190eeb5c9d849b71f457b15b308c94cbaf08\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/763780ef0336a973e933e40e919339381732dcaf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a942ec2745ca864cd8512142100e4027dc306a42\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/37a7559dc1358a8d300437e99ed8ecdab0671507\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/39d26cf46306bdc7ae809ecfdbfeff5aa1098911\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/63da190eeb5c9d849b71f457b15b308c94cbaf08\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/763780ef0336a973e933e40e919339381732dcaf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a942ec2745ca864cd8512142100e4027dc306a42\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:52:26+00:00",
      "cve": "CVE-2024-38545",
      "id": "CVE-2024-38545",
      "initial_release_date": "2024-06-19T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/hns: Fix UAF for cq async event",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-38545.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/763780ef0336a973e933e40e919339381732dcaf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/63da190eeb5c9d849b71f457b15b308c94cbaf08\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/39d26cf46306bdc7ae809ecfdbfeff5aa1098911\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/37a7559dc1358a8d300437e99ed8ecdab0671507\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a942ec2745ca864cd8512142100e4027dc306a42\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:12:25.134Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38545\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:15:07.173513Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:27.212Z\"}}], \"cna\": {\"title\": \"RDMA/hns: Fix UAF for cq async event\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9a4435375cd1\", \"lessThan\": \"330c825e66ef\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a4435375cd1\", \"lessThan\": \"763780ef0336\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a4435375cd1\", \"lessThan\": \"63da190eeb5c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a4435375cd1\", \"lessThan\": \"39d26cf46306\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a4435375cd1\", \"lessThan\": \"37a7559dc135\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a4435375cd1\", \"lessThan\": \"a942ec2745ca\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/hw/hns/hns_roce_cq.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/hw/hns/hns_roce_cq.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/330c825e66ef65278e4ebe57fd49c1d6f3f4e34e\"}, {\"url\": \"https://git.kernel.org/stable/c/763780ef0336a973e933e40e919339381732dcaf\"}, {\"url\": \"https://git.kernel.org/stable/c/63da190eeb5c9d849b71f457b15b308c94cbaf08\"}, {\"url\": \"https://git.kernel.org/stable/c/39d26cf46306bdc7ae809ecfdbfeff5aa1098911\"}, {\"url\": \"https://git.kernel.org/stable/c/37a7559dc1358a8d300437e99ed8ecdab0671507\"}, {\"url\": \"https://git.kernel.org/stable/c/a942ec2745ca864cd8512142100e4027dc306a42\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/hns: Fix UAF for cq async event\\n\\nThe refcount of CQ is not protected by locks. When CQ asynchronous\\nevents and CQ destruction are concurrent, CQ may have been released,\\nwhich will cause UAF.\\n\\nUse the xa_lock() to protect the CQ refcount.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:29:36.690Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38545\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:29:36.690Z\", \"dateReserved\": \"2024-06-18T19:36:34.919Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T13:35:19.336Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.