Vulnerability-Lookup

FKIE_CVE-2024-40992

Vulnerability from fkie_nvd - Published: 2024-07-12 13:15 - Updated: 2026-08-04 11:19

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder length checking for UD request packets According to the IBA specification: If a UD request packet is detected with an invalid length, the request shall be an invalid request and it shall be silently dropped by the responder. The responder then waits for a new request packet. commit 689c5421bfe0 ("RDMA/rxe: Fix incorrect responder length checking") defers responder length check for UD QPs in function `copy_data`. But it introduces a regression issue for UD QPs. When the packet size is too large to fit in the receive buffer. `copy_data` will return error code -EINVAL. Then `send_data_in` will return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into ERROR state.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	6.10
linux	linux_kernel	6.10
linux	linux_kernel	6.10
linux	linux_kernel	6.10

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_resp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "163868ec1f6c610d16da9e458fe1dd7d5de97341",
              "status": "affected",
              "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c",
              "versionType": "git"
            },
            {
              "lessThan": "943c94f41dfe36536dc9aaa12c9efdf548ceb996",
              "status": "affected",
              "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c",
              "versionType": "git"
            },
            {
              "lessThan": "f67ac0061c7614c1548963d3ef1ee1606efd8636",
              "status": "affected",
              "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_resp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1046C95-860A-45B0-B718-2B29F65BFF10",
              "versionEndExcluding": "6.6.36",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0A047AF2-94AC-4A3A-B32D-6AB930D8EF1C",
              "versionEndExcluding": "6.9.7",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "2EBB4392-5FA6-4DA9-9772-8F9C750109FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "331C2F14-12C7-45D5-893D-8C52EE38EA10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "3173713D-909A-4DD3-9DD4-1E171EB057EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "79F18AFA-40F7-43F0-BA30-7BDB65F918B9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix responder length checking for UD request packets\n\nAccording to the IBA specification:\nIf a UD request packet is detected with an invalid length, the request\nshall be an invalid request and it shall be silently dropped by\nthe responder. The responder then waits for a new request packet.\n\ncommit 689c5421bfe0 (\"RDMA/rxe: Fix incorrect responder length checking\")\ndefers responder length check for UD QPs in function `copy_data`.\nBut it introduces a regression issue for UD QPs.\n\nWhen the packet size is too large to fit in the receive buffer.\n`copy_data` will return error code -EINVAL. Then `send_data_in`\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\nERROR state."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/rxe: corrige la comprobaci\u00f3n de la longitud del respondedor para los paquetes de solicitud UD. Seg\u00fan la especificaci\u00f3n IBA: si se detecta un paquete de solicitud UD con una longitud no v\u00e1lida, la solicitud ser\u00e1 una solicitud no v\u00e1lida y El respondedor lo dejar\u00e1 caer silenciosamente. Luego, el respondedor espera un nuevo paquete de solicitud. El commit 689c5421bfe0 (\"RDMA/rxe: corregir la verificaci\u00f3n incorrecta de la longitud del respondedor\") pospone la verificaci\u00f3n de la longitud del respondedor para los QP de UD en la funci\u00f3n `copy_data`. Pero introduce un problema de regresi\u00f3n para los QP de UD. Cuando el tama\u00f1o del paquete es demasiado grande para caber en el b\u00fafer de recepci\u00f3n. `copy_data` devolver\u00e1 el c\u00f3digo de error -EINVAL. Entonces `send_data_in` devolver\u00e1 RESPST_ERR_MALFORMED_WQE. UD QP pasar\u00e1 al estado ERROR."
    }
  ],
  "id": "CVE-2024-40992",
  "lastModified": "2026-08-04T11:19:14.093",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-40992",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-09-10T17:01:44.819044Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-07-12T13:15:20.497",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2024-40992 (GCVE-0-2024-40992)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:37 – Updated: 2026-08-05 11:34

Title

RDMA/rxe: Fix responder length checking for UD request packets

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 17:01 UTC

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/163868ec1f6c610d1…
https://git.kernel.org/stable/c/943c94f41dfe36536…
https://git.kernel.org/stable/c/f67ac0061c7614c15…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 689c5421bfe0eac65526bd97a466b9590a6aad3c , < 163868ec1f6c610d16da9e458fe1dd7d5de97341 (git) Affected: 689c5421bfe0eac65526bd97a466b9590a6aad3c , < 943c94f41dfe36536dc9aaa12c9efdf548ceb996 (git) Affected: 689c5421bfe0eac65526bd97a466b9590a6aad3c , < f67ac0061c7614c1548963d3ef1ee1606efd8636 (git)
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.36 , ≤ 6.6.* (semver) Unaffected: 6.9.7 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:39:56.166Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40992",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:01:44.819044Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:20.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_resp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "163868ec1f6c610d16da9e458fe1dd7d5de97341",
              "status": "affected",
              "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c",
              "versionType": "git"
            },
            {
              "lessThan": "943c94f41dfe36536dc9aaa12c9efdf548ceb996",
              "status": "affected",
              "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c",
              "versionType": "git"
            },
            {
              "lessThan": "f67ac0061c7614c1548963d3ef1ee1606efd8636",
              "status": "affected",
              "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_resp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.36",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.7",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix responder length checking for UD request packets\n\nAccording to the IBA specification:\nIf a UD request packet is detected with an invalid length, the request\nshall be an invalid request and it shall be silently dropped by\nthe responder. The responder then waits for a new request packet.\n\ncommit 689c5421bfe0 (\"RDMA/rxe: Fix incorrect responder length checking\")\ndefers responder length check for UD QPs in function `copy_data`.\nBut it introduces a regression issue for UD QPs.\n\nWhen the packet size is too large to fit in the receive buffer.\n`copy_data` will return error code -EINVAL. Then `send_data_in`\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\nERROR state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The rxe driver processes RoCEv2 packets received on UDP port 4791 from arbitrary remote peers over routed IP networks, and the malformed UD request is handled directly in the responder receive path. No adjacency or local access is required.\nAC:L - A single crafted UD SEND packet whose payload exceeds the receiver\u0027s posted receive buffer deterministically triggers the wrong error class and the QP error transition; there is no race, no memory-layout dependency, and the GSI Q_Key is a hardcoded well-known constant.\nPR:N - RoCE provides no authentication, check_addr() performs no source validation for UD/GSI QPs, the default full P_Key always matches, and QPN 1 uses the fixed GSI_QKEY value \u2014 so a completely unauthenticated off-system attacker can reach the vulnerable code.\nUI:N - The vulnerability is triggered entirely by an inbound packet processed asynchronously by the responder task; no action by any local user or application is needed.\nS:U - The impact is confined to the kernel\u0027s RDMA subsystem on the target host, within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - copy_data() still bounds the transfer against dma.resid, so no out-of-bounds read occurs and no memory contents are disclosed; the defect is only the error code returned on an already-detected overlong payload.\nI:N - There is no memory corruption or out-of-bounds write \u2014 the receive-buffer copy remains bounded and the failure is reported to the application via an error completion, so no data is silently modified.\nA:H - A single unauthenticated packet permanently forces the UD/GSI queue pair into IB_QPS_ERR via rxe_qp_error(), flushing all work requests and rendering the QP unusable until the application tears it down and recreates it; killing QP1 disables the MAD agent and thus RDMA-CM connection establishment for the entire device, and one multicast packet can destroy every QP in a group."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:30.286Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"
        },
        {
          "url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"
        },
        {
          "url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"
        }
      ],
      "title": "RDMA/rxe: Fix responder length checking for UD request packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40992",
    "datePublished": "2024-07-12T12:37:35.800Z",
    "dateReserved": "2024-07-12T12:17:45.605Z",
    "dateUpdated": "2026-08-05T11:34:30.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2024-40992

CVE-2024-40992 (GCVE-0-2024-40992)

Tags

Sightings

Nomenclature

Related by attack behaviour