{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-42145", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-29T15:50:41.190Z", "datePublished": "2024-07-30T07:46:38.650Z", "dateUpdated": "2026-08-05T11:35:51.819Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:35:51.819Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/core: Implement a limit on UMAD receive List\n\nThe existing behavior of ib_umad, which maintains received MAD\npackets in an unbounded list, poses a risk of uncontrolled growth.\nAs user-space applications extract packets from this list, the rate\nof extraction may not match the rate of incoming packets, leading\nto potential list overflow.\n\nTo address this, we introduce a limit to the size of the list. After\nconsidering typical scenarios, such as OpenSM processing, which can\nhandle approximately 100k packets per second, and the 1-second retry\ntimeout for most packets, we set the list size limit to 200k. Packets\nreceived beyond this limit are dropped, assuming they are likely timed\nout by the time they are handled by user-space.\n\nNotably, packets queued on the receive list due to reasons like\ntimed-out sends are preserved even when the list is full." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable code is driven entirely by MAD packets arriving from the fabric; ib_umad devices are created for every port with rdma_cap_ib_mad(), which includes RoCE and RoCEv2 ports whose GSI (QP1) traffic is UDP/4791-encapsulated and fully IP-routable, and IB GMPs with a GRH are routable across subnets.\nAC:L - The attacker simply sends MADs faster than the userspace agent drains them, which the commit message itself notes is easy (OpenSM handles only ~100k packets/sec while the link delivers far more); no memory layout, timing window, or victim state outside the attacker's control is involved.\nPR:N - The path from ib_mad_recv_done() to queue_packet() contains no capability check and no authentication — only P_Key/IB-security enforcement, which admits any node in the default partition — and user_mad.c has no capable()/CAP_* checks at all.\nUI:N - Queueing happens in the MAD completion handler as packets arrive; no action by any local user or administrator is needed once a umad consumer such as OpenSM, ibacm, or srp_daemon is running, which is the normal state of an RDMA host.\nS:U - The unbounded allocations exhaust kernel memory on the same host running the vulnerable driver, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:N - The defect is purely an unbounded list of correctly-formed packets; nothing is read out of bounds and no kernel memory contents are exposed to the attacker.\nI:N - No memory corruption, out-of-bounds write, or type confusion occurs — packets are simply queued rather than dropped, so no kernel or user data is modified.\nA:H - Unbounded, non-memcg-accounted kernel memory growth at wire rate leads to full system memory exhaustion, OOM kills, and hangs, and also starves the subnet-management daemon that the queue belongs to." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/core/user_mad.c" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "1288cf1cceb0e6df276e182f5412370fb4169bcb", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b4913702419d064ec4c4bbf7270643c95cc89a1b", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "62349fbf86b5e13b02721bdadf98c29afd1e7b5f", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "d73cb8862e4d6760ccc94d3b57b9ef6271400607", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "63d202d948bb6d3a28cd8e8b96b160fa53e18baa", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b8c5f635997f49c625178d1a0cb32a80ed33abe6", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "a6627fba793cc75b7365d9504a0095fb2902dda4", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "ca0b44e20a6f3032224599f02e7c8fb49525c894", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/core/user_mad.c" ], "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.318", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.280", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.222", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.163", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.98", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.39", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.9", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "4.19.318" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.4.280" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.10.222" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.15.163" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.98" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.9.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1288cf1cceb0e6df276e182f5412370fb4169bcb" }, { "url": "https://git.kernel.org/stable/c/b4913702419d064ec4c4bbf7270643c95cc89a1b" }, { "url": "https://git.kernel.org/stable/c/62349fbf86b5e13b02721bdadf98c29afd1e7b5f" }, { "url": "https://git.kernel.org/stable/c/d73cb8862e4d6760ccc94d3b57b9ef6271400607" }, { "url": "https://git.kernel.org/stable/c/63d202d948bb6d3a28cd8e8b96b160fa53e18baa" }, { "url": "https://git.kernel.org/stable/c/b8c5f635997f49c625178d1a0cb32a80ed33abe6" }, { "url": "https://git.kernel.org/stable/c/a6627fba793cc75b7365d9504a0095fb2902dda4" }, { "url": "https://git.kernel.org/stable/c/ca0b44e20a6f3032224599f02e7c8fb49525c894" } ], "title": "IB/core: Implement a limit on UMAD receive List", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/1288cf1cceb0e6df276e182f5412370fb4169bcb", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b4913702419d064ec4c4bbf7270643c95cc89a1b", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/62349fbf86b5e13b02721bdadf98c29afd1e7b5f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/d73cb8862e4d6760ccc94d3b57b9ef6271400607", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/63d202d948bb6d3a28cd8e8b96b160fa53e18baa", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b8c5f635997f49c625178d1a0cb32a80ed33abe6", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/a6627fba793cc75b7365d9504a0095fb2902dda4", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ca0b44e20a6f3032224599f02e7c8fb49525c894", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:02:11.211Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-42145", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:15:44.209486Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:35.248Z" } } ] } }