GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47614 (GCVE-0-2021-47614)

Vulnerability from cvelistv5 – Published: 2024-06-19 14:58 – Updated: 2026-08-05 08:48
VLAI
Title
RDMA/irdma: Fix a user-after-free in add_pble_prm
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix a user-after-free in add_pble_prm When irdma_hmc_sd_one fails, 'chunk' is freed while its still on the PBLE info list. Add the chunk entry to the PBLE info list only after successful setting of the SD in irdma_hmc_sd_one.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:11 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e8c4dbc2fcacf5a7468d312168bb120c27c38b32 , < 11eebcf63e98fcf047a876a51d76afdabc3b8b9b (git)
Affected: e8c4dbc2fcacf5a7468d312168bb120c27c38b32 , < 1e11a39a82e95ce86f849f40dda0d9c0498cebd9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.10 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:47:40.790Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/11eebcf63e98fcf047a876a51d76afdabc3b8b9b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1e11a39a82e95ce86f849f40dda0d9c0498cebd9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47614",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:11:52.033975Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:50.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/irdma/pble.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "11eebcf63e98fcf047a876a51d76afdabc3b8b9b",
              "status": "affected",
              "version": "e8c4dbc2fcacf5a7468d312168bb120c27c38b32",
              "versionType": "git"
            },
            {
              "lessThan": "1e11a39a82e95ce86f849f40dda0d9c0498cebd9",
              "status": "affected",
              "version": "e8c4dbc2fcacf5a7468d312168bb120c27c38b32",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/irdma/pble.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.10",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix a user-after-free in add_pble_prm\n\nWhen irdma_hmc_sd_one fails, \u0027chunk\u0027 is freed while its still on the PBLE\ninfo list.\n\nAdd the chunk entry to the PBLE info list only after successful setting of\nthe SD in irdma_hmc_sd_one."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local RDMA verbs (reg_user_mr/alloc_mr \u2192 irdma_get_pble \u2192 add_pble_prm) via /dev/infiniband/uverbs*, not by parsing remote RDMA/iWARP packets.\nAC:L - An attacker can exhaust the PBLE pool with large MR registrations to force add_pble_prm, then induce irdma_hmc_sd_one failure via CQP request GFP_ATOMIC exhaustion or concurrent CQP load; once planted, subsequent get_pbles walks the freed chunk deterministically.\nPR:L - uverbs nodes default to mode 0666 and REG_MR/alloc_mr require no capability; InfiniBand verbs are intentionally usable by unprivileged processes once an irdma device is present.\nUI:N - The attacker opens uverbs and issues memory-registration verbs themselves; no separate victim action is required.\nS:U - Impact is host-kernel heap corruption / privilege escalation within the same OS security authority, with no VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - The freed irdma_chunk remains on pinfo.clist and is later used by irdma_prm_get_pbles (bitmapbuf/vaddr), yielding a classic slab UAF that enables arbitrary kernel memory disclosure.\nI:H - The same reclaimable chunk UAF (and destroy-path double-free) enables heap spraying and arbitrary write/control-flow hijack primitives consistent with UAF scoring guidance.\nA:H - Walking or freeing the dangling chunk list entry causes kernel oops/panic even without a full exploit, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:38.472Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/11eebcf63e98fcf047a876a51d76afdabc3b8b9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e11a39a82e95ce86f849f40dda0d9c0498cebd9"
        }
      ],
      "title": "RDMA/irdma: Fix a user-after-free in add_pble_prm",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47614",
    "datePublished": "2024-06-19T14:58:02.467Z",
    "dateReserved": "2024-06-19T14:55:32.795Z",
    "dateUpdated": "2026-08-05T08:48:38.472Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47614",
      "date": "2026-09-14",
      "epss": "0.00217",
      "percentile": "0.12138"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47614\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T15:15:55.943\",\"lastModified\":\"2026-08-04T10:17:11.030\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/irdma: Fix a user-after-free in add_pble_prm\\n\\nWhen irdma_hmc_sd_one fails, \u0027chunk\u0027 is freed while its still on the PBLE\\ninfo list.\\n\\nAdd the chunk entry to the PBLE info list only after successful setting of\\nthe SD in irdma_hmc_sd_one.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: RDMA/irdma: corrige un user-after-free en add_pble_prm Cuando falla irdma_hmc_sd_one, el \u0027fragmento\u0027 se libera mientras todav\u00eda est\u00e1 en la lista de informaci\u00f3n de PBLE. Agregue la entrada del fragmento a la lista de informaci\u00f3n de PBLE solo despu\u00e9s de configurar correctamente la SD en irdma_hmc_sd_one.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/hw/irdma/pble.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e8c4dbc2fcacf5a7468d312168bb120c27c38b32\",\"lessThan\":\"11eebcf63e98fcf047a876a51d76afdabc3b8b9b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e8c4dbc2fcacf5a7468d312168bb120c27c38b32\",\"lessThan\":\"1e11a39a82e95ce86f849f40dda0d9c0498cebd9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/hw/irdma/pble.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.10\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:11:52.033975Z\",\"id\":\"CVE-2021-47614\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"5.15.10\",\"matchCriteriaId\":\"1BBBBDA5-DDE7-4287-A1A6-9AABA5BC584D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11eebcf63e98fcf047a876a51d76afdabc3b8b9b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1e11a39a82e95ce86f849f40dda0d9c0498cebd9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/11eebcf63e98fcf047a876a51d76afdabc3b8b9b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1e11a39a82e95ce86f849f40dda0d9c0498cebd9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:53:00+00:00",
      "cve": "CVE-2021-47614",
      "id": "CVE-2021-47614",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:fixed": "150",
      "product_status:known_not_affected": "150",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/irdma: Fix a user-after-free in add_pble_prm",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47614.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/11eebcf63e98fcf047a876a51d76afdabc3b8b9b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1e11a39a82e95ce86f849f40dda0d9c0498cebd9\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:47:40.790Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47614\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:11:52.033975Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:26.302Z\"}}], \"cna\": {\"title\": \"RDMA/irdma: Fix a user-after-free in add_pble_prm\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached through local RDMA verbs (reg_user_mr/alloc_mr \\u2192 irdma_get_pble \\u2192 add_pble_prm) via /dev/infiniband/uverbs*, not by parsing remote RDMA/iWARP packets.\\nAC:L - An attacker can exhaust the PBLE pool with large MR registrations to force add_pble_prm, then induce irdma_hmc_sd_one failure via CQP request GFP_ATOMIC exhaustion or concurrent CQP load; once planted, subsequent get_pbles walks the freed chunk deterministically.\\nPR:L - uverbs nodes default to mode 0666 and REG_MR/alloc_mr require no capability; InfiniBand verbs are intentionally usable by unprivileged processes once an irdma device is present.\\nUI:N - The attacker opens uverbs and issues memory-registration verbs themselves; no separate victim action is required.\\nS:U - Impact is host-kernel heap corruption / privilege escalation within the same OS security authority, with no VM escape, IOMMU bypass, or other cross-boundary effect.\\nC:H - The freed irdma_chunk remains on pinfo.clist and is later used by irdma_prm_get_pbles (bitmapbuf/vaddr), yielding a classic slab UAF that enables arbitrary kernel memory disclosure.\\nI:H - The same reclaimable chunk UAF (and destroy-path double-free) enables heap spraying and arbitrary write/control-flow hijack primitives consistent with UAF scoring guidance.\\nA:H - Walking or freeing the dangling chunk list entry causes kernel oops/panic even without a full exploit, so availability impact is High.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e8c4dbc2fcacf5a7468d312168bb120c27c38b32\", \"lessThan\": \"11eebcf63e98fcf047a876a51d76afdabc3b8b9b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e8c4dbc2fcacf5a7468d312168bb120c27c38b32\", \"lessThan\": \"1e11a39a82e95ce86f849f40dda0d9c0498cebd9\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/hw/irdma/pble.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/hw/irdma/pble.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/11eebcf63e98fcf047a876a51d76afdabc3b8b9b\"}, {\"url\": \"https://git.kernel.org/stable/c/1e11a39a82e95ce86f849f40dda0d9c0498cebd9\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/irdma: Fix a user-after-free in add_pble_prm\\n\\nWhen irdma_hmc_sd_one fails, \u0027chunk\u0027 is freed while its still on the PBLE\\ninfo list.\\n\\nAdd the chunk entry to the PBLE info list only after successful setting of\\nthe SD in irdma_hmc_sd_one.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.10\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"5.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:48:38.472Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47614\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:48:38.472Z\", \"dateReserved\": \"2024-06-19T14:55:32.795Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T14:58:02.467Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.