{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47197", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-25T09:12:14.116Z", "datePublished": "2024-04-10T18:56:33.260Z", "dateUpdated": "2026-08-05T08:46:40.221Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:40.221Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()\n\nPrior to this patch in case mlx5_core_destroy_cq() failed it proceeds\nto rest of destroy operations. mlx5_core_destroy_cq() could be called again\nby user and cause additional call of mlx5_debug_cq_remove().\ncq->dbg was not nullify in previous call and cause the crash.\n\nFix it by nullify cq->dbg pointer after removal.\n\nAlso proceed to destroy operations only if FW return 0\nfor MLX5_CMD_OP_DESTROY_CQ command.\n\ngeneral protection fault, probably for non-canonical address 0x2000300004058: 0000 [#1] SMP PTI\nCPU: 5 PID: 1228 Comm: python Not tainted 5.15.0-rc5_for_upstream_min_debug_2021_10_14_11_06 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:lockref_get+0x1/0x60\nCode: 5d e9 53 ff ff ff 48 8d 7f 70 e8 0a 2e 48 00 c7 85 d0 00 00 00 02\n00 00 00 c6 45 70 00 fb 5d c3 c3 cc cc cc cc cc cc cc cc 53 <48> 8b 17\n48 89 fb 85 d2 75 3d 48 89 d0 bf 64 00 00 00 48 89 c1 48\nRSP: 0018:ffff888137dd7a38 EFLAGS: 00010206\nRAX: 0000000000000000 RBX: ffff888107d5f458 RCX: 00000000fffffffe\nRDX: 000000000002c2b0 RSI: ffffffff8155e2e0 RDI: 0002000300004058\nRBP: ffff888137dd7a88 R08: 0002000300004058 R09: ffff8881144a9f88\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8881141d4000\nR13: ffff888137dd7c68 R14: ffff888137dd7d58 R15: ffff888137dd7cc0\nFS: 00007f4644f2a4c0(0000) GS:ffff8887a2d40000(0000)\nknlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055b4500f4380 CR3: 0000000114f7a003 CR4: 0000000000170ea0\nCall Trace:\n simple_recursive_removal+0x33/0x2e0\n ? debugfs_remove+0x60/0x60\n debugfs_remove+0x40/0x60\n mlx5_debug_cq_remove+0x32/0x70 [mlx5_core]\n mlx5_core_destroy_cq+0x41/0x1d0 [mlx5_core]\n devx_obj_cleanup+0x151/0x330 [mlx5_ib]\n ? __pollwait+0xd0/0xd0\n ? xas_load+0x5/0x70\n ? xa_load+0x62/0xa0\n destroy_hw_idr_uobject+0x20/0x80 [ib_uverbs]\n uverbs_destroy_uobject+0x3b/0x360 [ib_uverbs]\n uobj_destroy+0x54/0xa0 [ib_uverbs]\n ib_uverbs_cmd_verbs+0xaf2/0x1160 [ib_uverbs]\n ? uverbs_finalize_object+0xd0/0xd0 [ib_uverbs]\n ib_uverbs_ioctl+0xc4/0x1b0 [ib_uverbs]\n __x64_sys_ioctl+0x3e4/0x8e0" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Reachable only via local ioctl on /dev/infiniband/uverbs* through ib_uverbs → DEVX/verbs destroy → mlx5_core_destroy_cq(); it is not triggered by remote packet processing.\nAC:L - An unprivileged attacker who can create a CQ fully controls create/destroy ioctls and can retry destroy (or close the uverbs fd) after a failed MLX5_CMD_OP_DESTROY_CQ, reliably hitting the second mlx5_debug_cq_remove() on the dangling pointer.\nPR:L - uverbs device nodes default to mode 0666, and enabling DEVX / destroying a CQ requires no capabilities (CAP_NET_RAW/CAP_SYS_RAWIO only unlock extra DEVX caps), so a normal local user is sufficient.\nUI:N - The attacker performs the create/destroy ioctls themselves; no separate victim action is required.\nS:U - Impact is confined to the host kernel privilege boundary (DoS or local privilege escalation); it does not cross VM/IOMMU or other security authorities.\nC:H - The bug is a use-after-free of the kmalloc'd mlx5_rsc_debug object (cq->dbg left dangling after rem_res_tree/kfree), which can be reclaimed and leveraged for arbitrary kernel reads.\nI:H - The same UAF plus double-free of cq->dbg enables heap spraying and corruption of the reused object (including a forged d->root passed into debugfs_remove_recursive), supporting write/control-flow primitives.\nA:H - The demonstrated general protection fault / kernel oops on the second destroy path crashes the kernel, and UAF paths remain crashable even when not fully exploited." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/cq.c", "drivers/net/ethernet/mellanox/mlx5/core/debugfs.c" ], "versions": [ { "version": "4f7bddf8c5c01cac74373443b13a68e1c6723a94", "lessThan": "471c492890557bd58f73314bb4ad85d5a8fd5026", "status": "affected", "versionType": "git" }, { "version": "94b960b9deffc02fc0747afc01f72cc62ab099e3", "lessThan": "2ae38157080616a13a9fe3f0b4b6ec0070aa408a", "status": "affected", "versionType": "git" }, { "version": "94b960b9deffc02fc0747afc01f72cc62ab099e3", "lessThan": "76ded29d3fcda4928da8849ffc446ea46871c1c2", "status": "affected", "versionType": "git" }, { "version": "ed8aafea4fec9c654e63445236e0b505e27ed3a7", "status": "affected", "versionType": "git" }, { "version": "5.10.75", "lessThan": "5.10.82", "status": "affected", "versionType": "semver" }, { "version": "5.14.14", "lessThan": "5.15", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/cq.c", "drivers/net/ethernet/mellanox/mlx5/core/debugfs.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.82", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.5", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.75", "versionEndExcluding": "5.10.82" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/471c492890557bd58f73314bb4ad85d5a8fd5026" }, { "url": "https://git.kernel.org/stable/c/2ae38157080616a13a9fe3f0b4b6ec0070aa408a" }, { "url": "https://git.kernel.org/stable/c/76ded29d3fcda4928da8849ffc446ea46871c1c2" } ], "title": "net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-21T16:04:48.403112Z", "id": "CVE-2021-47197", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-21T16:04:55.421Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:07.338Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/471c492890557bd58f73314bb4ad85d5a8fd5026", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/2ae38157080616a13a9fe3f0b4b6ec0070aa408a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/76ded29d3fcda4928da8849ffc446ea46871c1c2", "tags": [ "x_transferred" ] } ] } ] } }