Vulnerability-Lookup

GHSA-7J47-MXWC-G3XP

Vulnerability from github – Published: 2024-08-21 03:31 – Updated: 2026-10-30 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hns: Fix soft lockup under heavy CEQE load

CEQEs are handled in interrupt handler currently. This may cause the CPU core staying in interrupt context too long and lead to soft lockup under heavy load.

Handle CEQEs in BH workqueue and set an upper limit for the number of CEQE handled by a single call of work handler.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-43872"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-667"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-21T01:15:11Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix soft lockup under heavy CEQE load\n\nCEQEs are handled in interrupt handler currently. This may cause the\nCPU core staying in interrupt context too long and lead to soft lockup\nunder heavy load.\n\nHandle CEQEs in BH workqueue and set an upper limit for the number of\nCEQE handled by a single call of work handler.",
  "id": "GHSA-7j47-mxwc-g3xp",
  "modified": "2026-10-30T15:31:51Z",
  "published": "2024-08-21T03:31:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43872"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/06580b33c183c9f98e2a2ca96a86137179032c08"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/97740304c953ac43aebd24678ae999fe0bc9decf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-43872 (GCVE-0-2024-43872)

Vulnerability from cvelistv5 – Published: 2024-08-21 00:06 – Updated: 2026-10-30 12:19

Title

RDMA/hns: Fix soft lockup under heavy CEQE load

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix soft lockup under heavy CEQE load CEQEs are handled in interrupt handler currently. This may cause the CPU core staying in interrupt context too long and lead to soft lockup under heavy load. Handle CEQEs in BH workqueue and set an upper limit for the number of CEQE handled by a single call of work handler.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:06 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7018 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/97740304c953ac43a…
https://git.kernel.org/stable/c/06580b33c183c9f98…
https://git.kernel.org/stable/c/2fdf34038369c0a27…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a5073d6054f75d7c94b3354206eec4b804d2fbd4 , < 97740304c953ac43aebd24678ae999fe0bc9decf (git) Affected: a5073d6054f75d7c94b3354206eec4b804d2fbd4 , < 06580b33c183c9f98e2a2ca96a86137179032c08 (git) Affected: a5073d6054f75d7c94b3354206eec4b804d2fbd4 , < 2fdf34038369c0a27811e7b4680662a14ada1d6b (git)
Linux	Linux	Affected: 4.16 Unaffected: 0 , < 4.16 (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.10.3 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43872",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:06:16.645858Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:18.467Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hns/hns_roce_device.h",
            "drivers/infiniband/hw/hns/hns_roce_hw_v2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "97740304c953ac43aebd24678ae999fe0bc9decf",
              "status": "affected",
              "version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4",
              "versionType": "git"
            },
            {
              "lessThan": "06580b33c183c9f98e2a2ca96a86137179032c08",
              "status": "affected",
              "version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4",
              "versionType": "git"
            },
            {
              "lessThan": "2fdf34038369c0a27811e7b4680662a14ada1d6b",
              "status": "affected",
              "version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hns/hns_roce_device.h",
            "drivers/infiniband/hw/hns/hns_roce_hw_v2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix soft lockup under heavy CEQE load\n\nCEQEs are handled in interrupt handler currently. This may cause the\nCPU core staying in interrupt context too long and lead to soft lockup\nunder heavy load.\n\nHandle CEQEs in BH workqueue and set an upper limit for the number of\nCEQE handled by a single call of work handler."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - CEQE production is driven by completions on armed CQs, which a remote RoCE peer generates directly via incoming SEND/RDMA-write-with-immediate, CM/MAD and RDMA-CM connection traffic to an RDMA-listening host (nvmet-rdma, NFS/RDMA, SMB Direct); RoCEv2 rides routable UDP/4791, so the completion flood that pins the CPU can be driven from off-segment.\nAC:L - No race, no memory-layout dependency, no timing window \u2014 the attacker simply sustains a high completion rate, and the unbounded hardirq drain loop cannot exit while the hardware keeps posting entries. This was hit by ordinary heavy load in production, so deliberate flooding is entirely reliable.\nPR:N - Receive completions are generated by the HCA at the queue level, before any ULP-level authentication \u2014 nvmet-rdma and NFS/RDMA post and complete receive buffers pre-auth, and RDMA-CM connection-establishment packets complete on armed CQs with no credentials at all. The alternative local path (unprivileged verbs access via world-readable /dev/infiniband/uverbs*) is only PR:L, so the unauthenticated remote path governs.\nUI:N - The attack is purely traffic-driven against a listening RDMA endpoint or an unprivileged local WR flood; no action by any user or administrator on the victim system is required.\nS:U - The CPU stall and watchdog lockup occur inside the kernel of the affected host, within the same security authority as the vulnerable driver; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The CQN read from the CEQE is masked with num_cqs-1 before the xa_load(), so there is no out-of-bounds read and no attacker-observable data is exposed \u2014 the defect is a failure to bound loop iterations, not a memory-safety error.\nI:N - No memory is corrupted and no data is modified; the loop only consumes valid, hardware-owned queue entries and dispatches legitimate completion callbacks.\nA:H - The CPU core is pinned indefinitely in hard interrupt context, producing a soft lockup with cascading RCU stalls and scheduler starvation, and the missed update_eq_db() lets the CEQ overflow into device reset; on hosts with kernel.softlockup_panic=1 (common in kdump/HA configurations) this is an outright kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:19:05.518Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/97740304c953ac43aebd24678ae999fe0bc9decf"
        },
        {
          "url": "https://git.kernel.org/stable/c/06580b33c183c9f98e2a2ca96a86137179032c08"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b"
        }
      ],
      "title": "RDMA/hns: Fix soft lockup under heavy CEQE load",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43872",
    "datePublished": "2024-08-21T00:06:24.041Z",
    "dateReserved": "2024-08-17T09:11:59.281Z",
    "dateUpdated": "2026-10-30T12:19:05.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted