Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-47541
HistoryMay 24, 2024 - 12:00 a.m.

CVE-2021-47541

2024-05-2400:00:00
ubuntu.com
ubuntu.com
2
linux kernel
vulnerability
cve-2021-47541
net/mlx4_en
use-after-free
bug
static analyzer
security operations

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

In the Linux kernel, the following vulnerability has been resolved:
net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() In
mlx4_en_try_alloc_resources(), mlx4_en_copy_priv() is called and tmp->tx_cq
will be freed on the error path of mlx4_en_copy_priv(). After that
mlx4_en_alloc_resources() is called and there is a dereference of
&tmp->tx_cq[t][i] in mlx4_en_alloc_resources(), which could lead to a use
after free problem on failure of mlx4_en_copy_priv(). Fix this bug by
adding a check of mlx4_en_copy_priv() This bug was found by a static
analyzer. The analysis employs differential checking to identify
inconsistent security operations (e.g., checks or kfrees) between two code
paths and confirms that the inconsistent operations are not recovered in
the current function or the callers, so they constitute bugs. Note that, as
a bug found by static analysis, it can be a false positive or hard to
trigger. Multiple researchers have cross-reviewed the bug. Builds with
CONFIG_MLX4_EN=m show no new warnings, and our static analyzer no longer
warns about this code.

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%