{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-43872", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-17T09:11:59.281Z", "datePublished": "2024-08-21T00:06:24.041Z", "dateUpdated": "2026-08-05T11:36:52.386Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:52.386Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix soft lockup under heavy CEQE load\n\nCEQEs are handled in interrupt handler currently. This may cause the\nCPU core staying in interrupt context too long and lead to soft lockup\nunder heavy load.\n\nHandle CEQEs in BH workqueue and set an upper limit for the number of\nCEQE handled by a single call of work handler." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - CEQE production is driven by completions on armed CQs, which a remote RoCE peer generates directly via incoming SEND/RDMA-write-with-immediate, CM/MAD and RDMA-CM connection traffic to an RDMA-listening host (nvmet-rdma, NFS/RDMA, SMB Direct); RoCEv2 rides routable UDP/4791, so the completion flood that pins the CPU can be driven from off-segment.\nAC:L - No race, no memory-layout dependency, no timing window — the attacker simply sustains a high completion rate, and the unbounded hardirq drain loop cannot exit while the hardware keeps posting entries. This was hit by ordinary heavy load in production, so deliberate flooding is entirely reliable.\nPR:N - Receive completions are generated by the HCA at the queue level, before any ULP-level authentication — nvmet-rdma and NFS/RDMA post and complete receive buffers pre-auth, and RDMA-CM connection-establishment packets complete on armed CQs with no credentials at all. The alternative local path (unprivileged verbs access via world-readable /dev/infiniband/uverbs*) is only PR:L, so the unauthenticated remote path governs.\nUI:N - The attack is purely traffic-driven against a listening RDMA endpoint or an unprivileged local WR flood; no action by any user or administrator on the victim system is required.\nS:U - The CPU stall and watchdog lockup occur inside the kernel of the affected host, within the same security authority as the vulnerable driver; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The CQN read from the CEQE is masked with num_cqs-1 before the xa_load(), so there is no out-of-bounds read and no attacker-observable data is exposed — the defect is a failure to bound loop iterations, not a memory-safety error.\nI:N - No memory is corrupted and no data is modified; the loop only consumes valid, hardware-owned queue entries and dispatches legitimate completion callbacks.\nA:H - The CPU core is pinned indefinitely in hard interrupt context, producing a soft lockup with cascading RCU stalls and scheduler starvation, and the missed update_eq_db() lets the CEQ overflow into device reset; on hosts with kernel.softlockup_panic=1 (common in kdump/HA configurations) this is an outright kernel panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/hw/hns/hns_roce_device.h", "drivers/infiniband/hw/hns/hns_roce_hw_v2.c" ], "versions": [ { "version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4", "lessThan": "06580b33c183c9f98e2a2ca96a86137179032c08", "status": "affected", "versionType": "git" }, { "version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4", "lessThan": "2fdf34038369c0a27811e7b4680662a14ada1d6b", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/hw/hns/hns_roce_device.h", "drivers/infiniband/hw/hns/hns_roce_hw_v2.c" ], "versions": [ { "version": "4.16", "status": "affected" }, { "version": "0", "lessThan": "4.16", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.3", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.10.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/06580b33c183c9f98e2a2ca96a86137179032c08" }, { "url": "https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b" } ], "title": "RDMA/hns: Fix soft lockup under heavy CEQE load", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-43872", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:06:16.645858Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:18.467Z" } } ] } }