CVE-2024-43872 (GCVE-0-2024-43872)

Vulnerability from cvelistv5 – Published: 2024-08-21 00:06 – Updated: 2026-08-05 11:36
VLAI
Title
RDMA/hns: Fix soft lockup under heavy CEQE load
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix soft lockup under heavy CEQE load CEQEs are handled in interrupt handler currently. This may cause the CPU core staying in interrupt context too long and lead to soft lockup under heavy load. Handle CEQEs in BH workqueue and set an upper limit for the number of CEQE handled by a single call of work handler.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a5073d6054f75d7c94b3354206eec4b804d2fbd4 , < 06580b33c183c9f98e2a2ca96a86137179032c08 (git)
Affected: a5073d6054f75d7c94b3354206eec4b804d2fbd4 , < 2fdf34038369c0a27811e7b4680662a14ada1d6b (git)
Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 6.10.3 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43872",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:06:16.645858Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:18.467Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hns/hns_roce_device.h",
            "drivers/infiniband/hw/hns/hns_roce_hw_v2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "06580b33c183c9f98e2a2ca96a86137179032c08",
              "status": "affected",
              "version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4",
              "versionType": "git"
            },
            {
              "lessThan": "2fdf34038369c0a27811e7b4680662a14ada1d6b",
              "status": "affected",
              "version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hns/hns_roce_device.h",
            "drivers/infiniband/hw/hns/hns_roce_hw_v2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix soft lockup under heavy CEQE load\n\nCEQEs are handled in interrupt handler currently. This may cause the\nCPU core staying in interrupt context too long and lead to soft lockup\nunder heavy load.\n\nHandle CEQEs in BH workqueue and set an upper limit for the number of\nCEQE handled by a single call of work handler."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - CEQE production is driven by completions on armed CQs, which a remote RoCE peer generates directly via incoming SEND/RDMA-write-with-immediate, CM/MAD and RDMA-CM connection traffic to an RDMA-listening host (nvmet-rdma, NFS/RDMA, SMB Direct); RoCEv2 rides routable UDP/4791, so the completion flood that pins the CPU can be driven from off-segment.\nAC:L - No race, no memory-layout dependency, no timing window \u2014 the attacker simply sustains a high completion rate, and the unbounded hardirq drain loop cannot exit while the hardware keeps posting entries. This was hit by ordinary heavy load in production, so deliberate flooding is entirely reliable.\nPR:N - Receive completions are generated by the HCA at the queue level, before any ULP-level authentication \u2014 nvmet-rdma and NFS/RDMA post and complete receive buffers pre-auth, and RDMA-CM connection-establishment packets complete on armed CQs with no credentials at all. The alternative local path (unprivileged verbs access via world-readable /dev/infiniband/uverbs*) is only PR:L, so the unauthenticated remote path governs.\nUI:N - The attack is purely traffic-driven against a listening RDMA endpoint or an unprivileged local WR flood; no action by any user or administrator on the victim system is required.\nS:U - The CPU stall and watchdog lockup occur inside the kernel of the affected host, within the same security authority as the vulnerable driver; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The CQN read from the CEQE is masked with num_cqs-1 before the xa_load(), so there is no out-of-bounds read and no attacker-observable data is exposed \u2014 the defect is a failure to bound loop iterations, not a memory-safety error.\nI:N - No memory is corrupted and no data is modified; the loop only consumes valid, hardware-owned queue entries and dispatches legitimate completion callbacks.\nA:H - The CPU core is pinned indefinitely in hard interrupt context, producing a soft lockup with cascading RCU stalls and scheduler starvation, and the missed update_eq_db() lets the CEQ overflow into device reset; on hosts with kernel.softlockup_panic=1 (common in kdump/HA configurations) this is an outright kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:52.386Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/06580b33c183c9f98e2a2ca96a86137179032c08"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b"
        }
      ],
      "title": "RDMA/hns: Fix soft lockup under heavy CEQE load",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43872",
    "datePublished": "2024-08-21T00:06:24.041Z",
    "dateReserved": "2024-08-17T09:11:59.281Z",
    "dateUpdated": "2026-08-05T11:36:52.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-43872",
      "date": "2026-08-08",
      "epss": "0.00321",
      "percentile": "0.24534"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:44:38.000Z",
      "cve": "CVE-2024-43872",
      "id": "msrc_CVE-2024-43872",
      "initial_release_date": "2024-08-02T00:00:00.000Z",
      "product_status:under_investigation": "19",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/hns: Fix soft lockup under heavy CEQE load",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-43872.json",
      "version": "14"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43872\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-21T01:15:11.740\",\"lastModified\":\"2026-06-17T07:51:53.903\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/hns: Fix soft lockup under heavy CEQE load\\n\\nCEQEs are handled in interrupt handler currently. This may cause the\\nCPU core staying in interrupt context too long and lead to soft lockup\\nunder heavy load.\\n\\nHandle CEQEs in BH workqueue and set an upper limit for the number of\\nCEQE handled by a single call of work handler.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: RDMA/hns: corrige el bloqueo suave bajo carga pesada de CEQE. Actualmente, los CEQE se manejan en el controlador de interrupciones. Esto puede hacer que el n\u00facleo de la CPU permanezca en el contexto de interrupci\u00f3n durante demasiado tiempo y provocar un bloqueo suave bajo una carga pesada. Maneje CEQE en la cola de trabajo de BH y establezca un l\u00edmite superior para la cantidad de CEQE manejados por una sola llamada de controlador de trabajo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/hw/hns/hns_roce_device.h\",\"drivers/infiniband/hw/hns/hns_roce_hw_v2.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a5073d6054f75d7c94b3354206eec4b804d2fbd4\",\"lessThan\":\"06580b33c183c9f98e2a2ca96a86137179032c08\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a5073d6054f75d7c94b3354206eec4b804d2fbd4\",\"lessThan\":\"2fdf34038369c0a27811e7b4680662a14ada1d6b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/hw/hns/hns_roce_device.h\",\"drivers/infiniband/hw/hns/hns_roce_hw_v2.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.3\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:06:16.645858Z\",\"id\":\"CVE-2024-43872\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.16\",\"versionEndExcluding\":\"6.10.3\",\"matchCriteriaId\":\"B2194910-A867-4355-9344-95E7D3E499E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06580b33c183c9f98e2a2ca96a86137179032c08\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:13:00+00:00",
      "cve": "CVE-2024-43872",
      "id": "CVE-2024-43872",
      "initial_release_date": "2024-08-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/hns: Fix soft lockup under heavy CEQE load",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-43872.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43872\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:06:16.645858Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:22.673Z\"}}], \"cna\": {\"title\": \"RDMA/hns: Fix soft lockup under heavy CEQE load\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a5073d6054f75d7c94b3354206eec4b804d2fbd4\", \"lessThan\": \"06580b33c183c9f98e2a2ca96a86137179032c08\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a5073d6054f75d7c94b3354206eec4b804d2fbd4\", \"lessThan\": \"2fdf34038369c0a27811e7b4680662a14ada1d6b\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/hw/hns/hns_roce_device.h\", \"drivers/infiniband/hw/hns/hns_roce_hw_v2.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/hw/hns/hns_roce_device.h\", \"drivers/infiniband/hw/hns/hns_roce_hw_v2.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/06580b33c183c9f98e2a2ca96a86137179032c08\"}, {\"url\": \"https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/hns: Fix soft lockup under heavy CEQE load\\n\\nCEQEs are handled in interrupt handler currently. This may cause the\\nCPU core staying in interrupt context too long and lead to soft lockup\\nunder heavy load.\\n\\nHandle CEQEs in BH workqueue and set an upper limit for the number of\\nCEQE handled by a single call of work handler.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.3\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"4.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:31:27.533Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43872\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:31:27.533Z\", \"dateReserved\": \"2024-08-17T09:11:59.281Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-21T00:06:24.041Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.