{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47438", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T14:58:30.831Z", "datePublished": "2024-05-22T06:19:33.537Z", "dateUpdated": "2026-08-05T08:47:48.724Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:47:48.724Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path\n\nPrior to this patch in case mlx5_core_destroy_cq() failed it returns\nwithout completing all destroy operations and that leads to memory leak.\nInstead, complete the destroy flow before return error.\n\nAlso move mlx5_debug_cq_remove() to the beginning of mlx5_core_destroy_cq()\nto be symmetrical with mlx5_core_create_cq().\n\nkmemleak complains on:\n\nunreferenced object 0xc000000038625100 (size 64):\n comm \"ethtool\", pid 28301, jiffies 4298062946 (age 785.380s)\n hex dump (first 32 bytes):\n 60 01 48 94 00 00 00 c0 b8 05 34 c3 00 00 00 c0 `.H.......4.....\n 02 00 00 00 00 00 00 00 00 db 7d c1 00 00 00 c0 ..........}.....\n backtrace:\n [<000000009e8643cb>] add_res_tree+0xd0/0x270 [mlx5_core]\n [<00000000e7cb8e6c>] mlx5_debug_cq_add+0x5c/0xc0 [mlx5_core]\n [<000000002a12918f>] mlx5_core_create_cq+0x1d0/0x2d0 [mlx5_core]\n [<00000000cef0a696>] mlx5e_create_cq+0x210/0x3f0 [mlx5_core]\n [<000000009c642c26>] mlx5e_open_cq+0xb4/0x130 [mlx5_core]\n [<0000000058dfa578>] mlx5e_ptp_open+0x7f4/0xe10 [mlx5_core]\n [<0000000081839561>] mlx5e_open_channels+0x9cc/0x13e0 [mlx5_core]\n [<0000000009cf05d4>] mlx5e_switch_priv_channels+0xa4/0x230\n[mlx5_core]\n [<0000000042bbedd8>] mlx5e_safe_switch_params+0x14c/0x300\n[mlx5_core]\n [<0000000004bc9db8>] set_pflag_tx_port_ts+0x9c/0x160 [mlx5_core]\n [<00000000a0553443>] mlx5e_set_priv_flags+0xd0/0x1b0 [mlx5_core]\n [<00000000a8f3d84b>] ethnl_set_privflags+0x234/0x2d0\n [<00000000fd27f27c>] genl_family_rcv_msg_doit+0x108/0x1d0\n [<00000000f495e2bb>] genl_family_rcv_msg+0xe4/0x1f0\n [<00000000646c5c2c>] genl_rcv_msg+0x78/0x120\n [<00000000d53e384e>] netlink_rcv_skb+0x74/0x1a0" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Reachable only via local interfaces (ethtool/netlink PRIVFLAGS_SET or RDMA uverbs/DEVX CQ destroy on mlx5), not by processing remote network packets.\nAC:L - A local actor who can drive CQ destroy (ethtool priv-flag/channel reconfiguration or IB CQ destroy) can exercise the vulnerable path; no special race or non-attacker-controlled layout is required beyond inducing the destroy error path.\nPR:L - ETHTOOL_MSG_PRIVFLAGS_SET uses GENL_UNS_ADMIN_PERM (CAP_NET_ADMIN in the local user namespace), and mlx5 IB uverbs nodes are mode 0666, so an unprivileged local user can reach CQ destroy without real init-namespace root.\nUI:N - Exploitation requires only attacker-controlled local syscalls/netlink or uverbs operations; no victim action is needed.\nS:U - Impact stays within the host kernel authority (memory leak / UAF); it does not cross VM, IOMMU, or other security boundaries.\nC:H - On the failing destroy path, debugfs CQ entries are left registered while mlx5e frees the CQ object, so subsequent debugfs reads use a dangling pointer (UAF) and can disclose freed kernel memory.\nI:N - The bug is an incomplete teardown/memory leak with a read-only debugfs UAF; there is no demonstrated attacker write or control-flow corruption primitive in this path.\nA:H - The dangling CQ debugfs UAF can oops the kernel on access, and repeated failed destroys leak kernel allocations, so availability impact is high." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/cq.c" ], "versions": [ { "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c", "lessThan": "4f7bddf8c5c01cac74373443b13a68e1c6723a94", "status": "affected", "versionType": "git" }, { "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c", "lessThan": "ed8aafea4fec9c654e63445236e0b505e27ed3a7", "status": "affected", "versionType": "git" }, { "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c", "lessThan": "94b960b9deffc02fc0747afc01f72cc62ab099e3", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/cq.c" ], "versions": [ { "version": "3.11", "status": "affected" }, { "version": "0", "lessThan": "3.11", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.75", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.14.14", "lessThanOrEqual": "5.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11", "versionEndExcluding": "5.10.75" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11", "versionEndExcluding": "5.14.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11", "versionEndExcluding": "5.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4f7bddf8c5c01cac74373443b13a68e1c6723a94" }, { "url": "https://git.kernel.org/stable/c/ed8aafea4fec9c654e63445236e0b505e27ed3a7" }, { "url": "https://git.kernel.org/stable/c/94b960b9deffc02fc0747afc01f72cc62ab099e3" } ], "title": "net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-17T18:03:33.416738Z", "id": "CVE-2021-47438", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T18:04:18.552Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.306Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/4f7bddf8c5c01cac74373443b13a68e1c6723a94", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ed8aafea4fec9c654e63445236e0b505e27ed3a7", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/94b960b9deffc02fc0747afc01f72cc62ab099e3", "tags": [ "x_transferred" ] } ] } ] } }