CVE-2021-47378 (GCVE-0-2021-47378)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:03 – Updated: 2026-08-05 08:47
VLAI
Title
nvme-rdma: destroy cm id before destroy qp to avoid use after free
Summary
In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: destroy cm id before destroy qp to avoid use after free We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use after free. In RDMA connection establishment error flow, don't destroy qp in cm event handler.Just report cm_error to upper level, qp will be destroy in nvme_rdma_alloc_queue() after destroy cm id.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7110230719602852481c2793d054f866b2bf4a2b , < ecf0dc5a904830c926a64feffd8e01141f89822f (git)
Affected: 7110230719602852481c2793d054f866b2bf4a2b , < d268a182c56e8361e19fb781137411643312b994 (git)
Affected: 7110230719602852481c2793d054f866b2bf4a2b , < 9817d763dbe15327b9b3ff4404fa6f27f927e744 (git)
Create a notification for this product.
Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 5.10.70 , ≤ 5.10.* (semver)
Unaffected: 5.14.9 , ≤ 5.14.* (semver)
Unaffected: 5.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
linux linux_kernel Affected: 1da177e4c3f4
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Unaffected: 5.10.70
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Unaffected: 5.14.9
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Unaffected: 5.15
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "1da177e4c3f4"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "5.10.70"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "5.14.9"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "5.15"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47378",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-16T21:04:16.754681Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-16T21:04:30.711Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.590Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ecf0dc5a904830c926a64feffd8e01141f89822f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d268a182c56e8361e19fb781137411643312b994"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9817d763dbe15327b9b3ff4404fa6f27f927e744"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ecf0dc5a904830c926a64feffd8e01141f89822f",
              "status": "affected",
              "version": "7110230719602852481c2793d054f866b2bf4a2b",
              "versionType": "git"
            },
            {
              "lessThan": "d268a182c56e8361e19fb781137411643312b994",
              "status": "affected",
              "version": "7110230719602852481c2793d054f866b2bf4a2b",
              "versionType": "git"
            },
            {
              "lessThan": "9817d763dbe15327b9b3ff4404fa6f27f927e744",
              "status": "affected",
              "version": "7110230719602852481c2793d054f866b2bf4a2b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.70",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.9",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: destroy cm id before destroy qp to avoid use after free\n\nWe should always destroy cm_id before destroy qp to avoid to get cma\nevent after qp was destroyed, which may lead to use after free.\nIn RDMA connection establishment error flow, don\u0027t destroy qp in cm\nevent handler.Just report cm_error to upper level, qp will be destroy\nin nvme_rdma_alloc_queue() after destroy cm id."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The nvme-rdma initiator processes RDMA CM events (REJECTED/CONNECT_ERROR/UNREACHABLE/DISCONNECTED) from a remote NVMe-oF peer over InfiniBand/RoCE/iWARP; a malicious or compromised target drives the buggy destroy-QP-before-cm_id paths via fabric protocol messages on connect/reconnect/teardown.\nAC:L - The remote peer fully controls CM handshake failures and disconnects that enter nvme_rdma_cm_handler and later free_queue, so it can reliably cause QP destruction while cm_id remains live and deliver further CMA events into the UAF window.\nPR:N - Once an NVMe-RDMA controller session exists (typical datacenter autoconnect), the attacker needs no account or capabilities on the victim host and triggers the bug solely as the unauthenticated fabric peer.\nUI:N - No extra victim action is required at exploit time beyond a pre-existing or auto-reconnecting NVMe-RDMA attachment; CM error and disconnect handling runs in kernel context from peer events.\nS:U - The use-after-free corrupts host-kernel RDMA/NVMe structures under the same OS security authority and does not cross a VM, IOMMU, or other distinct boundary.\nC:H - Destroying the QP/ring while cm_id can still deliver CMA callbacks is a kernel heap use-after-free; per UAF guidance this enables heap reuse and arbitrary kernel read primitives.\nI:H - The same freed QP-related objects are sprayable for arbitrary write and control-flow hijacking in kernel context once reclaimed.\nA:H - Use-after-free of the queue IB resources can oops/panic the kernel during CM handling or teardown even without a full exploit, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:47:31.303Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ecf0dc5a904830c926a64feffd8e01141f89822f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d268a182c56e8361e19fb781137411643312b994"
        },
        {
          "url": "https://git.kernel.org/stable/c/9817d763dbe15327b9b3ff4404fa6f27f927e744"
        }
      ],
      "title": "nvme-rdma: destroy cm id before destroy qp to avoid use after free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47378",
    "datePublished": "2024-05-21T15:03:41.038Z",
    "dateReserved": "2024-05-21T14:58:30.811Z",
    "dateUpdated": "2026-08-05T08:47:31.303Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47378",
      "date": "2026-08-05",
      "epss": "0.01166",
      "percentile": "0.64242"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47378\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:23.527\",\"lastModified\":\"2026-06-17T04:17:19.917\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvme-rdma: destroy cm id before destroy qp to avoid use after free\\n\\nWe should always destroy cm_id before destroy qp to avoid to get cma\\nevent after qp was destroyed, which may lead to use after free.\\nIn RDMA connection establishment error flow, don\u0027t destroy qp in cm\\nevent handler.Just report cm_error to upper level, qp will be destroy\\nin nvme_rdma_alloc_queue() after destroy cm id.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme-rdma: destruye cm id antes de destruir qp para evitar su use after free. Siempre debemos destruir cm_id antes de destruir qp para evitar que se produzca un evento cma despu\u00e9s de que se destruya qp, lo que puede llevar a use after free. En el flujo de error de establecimiento de conexi\u00f3n RDMA, no destruya qp en el controlador de eventos cm. Simplemente informe cm_error al nivel superior, qp se destruir\u00e1 en nvme_rdma_alloc_queue() despu\u00e9s de destruir cm id.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/nvme/host/rdma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7110230719602852481c2793d054f866b2bf4a2b\",\"lessThan\":\"ecf0dc5a904830c926a64feffd8e01141f89822f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7110230719602852481c2793d054f866b2bf4a2b\",\"lessThan\":\"d268a182c56e8361e19fb781137411643312b994\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7110230719602852481c2793d054f866b2bf4a2b\",\"lessThan\":\"9817d763dbe15327b9b3ff4404fa6f27f927e744\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/nvme/host/rdma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.70\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.14.9\",\"lessThanOrEqual\":\"5.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"1da177e4c3f4\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"5.10.70\",\"status\":\"unaffected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"5.14.9\",\"status\":\"unaffected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"5.15\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-01-16T21:04:16.754681Z\",\"id\":\"CVE-2021-47378\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.10.70\",\"matchCriteriaId\":\"8ECC9806-1A88-441B-9504-CD4A53C66847\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.14.9\",\"matchCriteriaId\":\"1B31D6C1-A751-438D-906B-0C56B789D498\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E46C74C6-B76B-4C94-A6A4-FD2FFF62D644\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/9817d763dbe15327b9b3ff4404fa6f27f927e744\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d268a182c56e8361e19fb781137411643312b994\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ecf0dc5a904830c926a64feffd8e01141f89822f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9817d763dbe15327b9b3ff4404fa6f27f927e744\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d268a182c56e8361e19fb781137411643312b994\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ecf0dc5a904830c926a64feffd8e01141f89822f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-01-22T09:00:54+00:00",
      "cve": "CVE-2021-47378",
      "id": "CVE-2021-47378",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:fixed": "665",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "85",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nvme-rdma: destroy cm id before destroy qp to avoid use after free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47378.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ecf0dc5a904830c926a64feffd8e01141f89822f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d268a182c56e8361e19fb781137411643312b994\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9817d763dbe15327b9b3ff4404fa6f27f927e744\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:08.590Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47378\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-16T21:04:16.754681Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f4\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.10.70\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.14.9\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.15\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-22T19:31:48.830Z\"}}], \"cna\": {\"title\": \"nvme-rdma: destroy cm id before destroy qp to avoid use after free\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The nvme-rdma initiator processes RDMA CM events (REJECTED/CONNECT_ERROR/UNREACHABLE/DISCONNECTED) from a remote NVMe-oF peer over InfiniBand/RoCE/iWARP; a malicious or compromised target drives the buggy destroy-QP-before-cm_id paths via fabric protocol messages on connect/reconnect/teardown.\\nAC:L - The remote peer fully controls CM handshake failures and disconnects that enter nvme_rdma_cm_handler and later free_queue, so it can reliably cause QP destruction while cm_id remains live and deliver further CMA events into the UAF window.\\nPR:N - Once an NVMe-RDMA controller session exists (typical datacenter autoconnect), the attacker needs no account or capabilities on the victim host and triggers the bug solely as the unauthenticated fabric peer.\\nUI:N - No extra victim action is required at exploit time beyond a pre-existing or auto-reconnecting NVMe-RDMA attachment; CM error and disconnect handling runs in kernel context from peer events.\\nS:U - The use-after-free corrupts host-kernel RDMA/NVMe structures under the same OS security authority and does not cross a VM, IOMMU, or other distinct boundary.\\nC:H - Destroying the QP/ring while cm_id can still deliver CMA callbacks is a kernel heap use-after-free; per UAF guidance this enables heap reuse and arbitrary kernel read primitives.\\nI:H - The same freed QP-related objects are sprayable for arbitrary write and control-flow hijacking in kernel context once reclaimed.\\nA:H - Use-after-free of the queue IB resources can oops/panic the kernel during CM handling or teardown even without a full exploit, fully denying availability.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7110230719602852481c2793d054f866b2bf4a2b\", \"lessThan\": \"ecf0dc5a904830c926a64feffd8e01141f89822f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7110230719602852481c2793d054f866b2bf4a2b\", \"lessThan\": \"d268a182c56e8361e19fb781137411643312b994\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7110230719602852481c2793d054f866b2bf4a2b\", \"lessThan\": \"9817d763dbe15327b9b3ff4404fa6f27f927e744\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/nvme/host/rdma.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.70\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/nvme/host/rdma.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ecf0dc5a904830c926a64feffd8e01141f89822f\"}, {\"url\": \"https://git.kernel.org/stable/c/d268a182c56e8361e19fb781137411643312b994\"}, {\"url\": \"https://git.kernel.org/stable/c/9817d763dbe15327b9b3ff4404fa6f27f927e744\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvme-rdma: destroy cm id before destroy qp to avoid use after free\\n\\nWe should always destroy cm_id before destroy qp to avoid to get cma\\nevent after qp was destroyed, which may lead to use after free.\\nIn RDMA connection establishment error flow, don\u0027t destroy qp in cm\\nevent handler.Just report cm_error to upper level, qp will be destroy\\nin nvme_rdma_alloc_queue() after destroy cm id.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.70\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14.9\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15\", \"versionStartIncluding\": \"4.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:47:31.303Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47378\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:47:31.303Z\", \"dateReserved\": \"2024-05-21T14:58:30.811Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:03:41.038Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.