{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-38545", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.919Z", "datePublished": "2024-06-19T13:35:19.336Z", "dateUpdated": "2026-08-05T11:32:42.888Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:42.888Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix UAF for cq async event\n\nThe refcount of CQ is not protected by locks. When CQ asynchronous\nevents and CQ destruction are concurrent, CQ may have been released,\nwhich will cause UAF.\n\nUse the xa_lock() to protect the CQ refcount." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires local access to the RDMA user-verbs character device (/dev/infiniband/uverbs*) to create/destroy CQs and post work requests; although a remote RoCE peer can help generate the CQ async events, the destroy side of the race is a local ioctl/write command.\nAC:L - The attacker controls both sides of the race — generating CQ_OVERFLOW/CQ_ACCESS_ERROR async events via its own RDMA traffic while destroying the CQ from another thread — and the racing code runs in preemptible workqueue context, so the window is wide and the attempt can be repeated indefinitely.\nPR:L - No capability check exists on the uverbs CQ create/destroy path, and /dev/infiniband/uverbs* is world-accessible under standard rdma-core udev rules, so any unprivileged local user on an RDMA-capable host can reach it.\nUI:N - The attacker performs all steps itself — creating the CQ, generating the async events, and destroying the CQ concurrently — with no victim action required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed hns_roce_cq slab object is dereferenced after kfree(), and reclaiming it with attacker-controlled data plus the resulting indirect call yields arbitrary kernel-memory read capability.\nI:H - The stale pointer is both written through (refcount_inc on freed memory) and used for an indirect call — ibcq->event_handler(&event, ibcq->cq_context) with a function pointer and argument read from the freed object — giving control-flow hijack and arbitrary write potential.\nA:H - Even without successful heap grooming, the use-after-free corrupts the slab and jumps through a stale function pointer, reliably producing a kernel oops or panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/hw/hns/hns_roce_cq.c" ], "versions": [ { "version": "9a4435375cd151e07c0c38fa601b00115986091b", "lessThan": "330c825e66ef65278e4ebe57fd49c1d6f3f4e34e", "status": "affected", "versionType": "git" }, { "version": "9a4435375cd151e07c0c38fa601b00115986091b", "lessThan": "763780ef0336a973e933e40e919339381732dcaf", "status": "affected", "versionType": "git" }, { "version": "9a4435375cd151e07c0c38fa601b00115986091b", "lessThan": "63da190eeb5c9d849b71f457b15b308c94cbaf08", "status": "affected", "versionType": "git" }, { "version": "9a4435375cd151e07c0c38fa601b00115986091b", "lessThan": "39d26cf46306bdc7ae809ecfdbfeff5aa1098911", "status": "affected", "versionType": "git" }, { "version": "9a4435375cd151e07c0c38fa601b00115986091b", "lessThan": "37a7559dc1358a8d300437e99ed8ecdab0671507", "status": "affected", "versionType": "git" }, { "version": "9a4435375cd151e07c0c38fa601b00115986091b", "lessThan": "a942ec2745ca864cd8512142100e4027dc306a42", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/hw/hns/hns_roce_cq.c" ], "versions": [ { "version": "4.9", "status": "affected" }, { "version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.93", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.12", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.3", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.93" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.33" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.8.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.9.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/330c825e66ef65278e4ebe57fd49c1d6f3f4e34e" }, { "url": "https://git.kernel.org/stable/c/763780ef0336a973e933e40e919339381732dcaf" }, { "url": "https://git.kernel.org/stable/c/63da190eeb5c9d849b71f457b15b308c94cbaf08" }, { "url": "https://git.kernel.org/stable/c/39d26cf46306bdc7ae809ecfdbfeff5aa1098911" }, { "url": "https://git.kernel.org/stable/c/37a7559dc1358a8d300437e99ed8ecdab0671507" }, { "url": "https://git.kernel.org/stable/c/a942ec2745ca864cd8512142100e4027dc306a42" } ], "title": "RDMA/hns: Fix UAF for cq async event", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:25.134Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/763780ef0336a973e933e40e919339381732dcaf", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/63da190eeb5c9d849b71f457b15b308c94cbaf08", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/39d26cf46306bdc7ae809ecfdbfeff5aa1098911", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/37a7559dc1358a8d300437e99ed8ecdab0671507", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/a942ec2745ca864cd8512142100e4027dc306a42", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-38545", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T17:15:07.173513Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:57.896Z" } } ] } }