{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47261", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T13:27:52.126Z", "datePublished": "2024-05-21T14:19:54.025Z", "dateUpdated": "2026-08-05T08:47:01.751Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:47:01.751Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx5: Fix initializing CQ fragments buffer\n\nThe function init_cq_frag_buf() can be called to initialize the current CQ\nfragments buffer cq->buf, or the temporary cq->resize_buf that is filled\nduring CQ resize operation.\n\nHowever, the offending commit started to use function get_cqe() for\ngetting the CQEs, the issue with this change is that get_cqe() always\nreturns CQEs from cq->buf, which leads us to initialize the wrong buffer,\nand in case of enlarging the CQ we try to access elements beyond the size\nof the current cq->buf and eventually hit a kernel panic.\n\n [exception RIP: init_cq_frag_buf+103]\n [ffff9f799ddcbcd8] mlx5_ib_resize_cq at ffffffffc0835d60 [mlx5_ib]\n [ffff9f799ddcbdb0] ib_resize_cq at ffffffffc05270df [ib_core]\n [ffff9f799ddcbdc0] llt_rdma_setup_qp at ffffffffc0a6a712 [llt]\n [ffff9f799ddcbe10] llt_rdma_cc_event_action at ffffffffc0a6b411 [llt]\n [ffff9f799ddcbe98] llt_rdma_client_conn_thread at ffffffffc0a6bb75 [llt]\n [ffff9f799ddcbec8] kthread at ffffffffa66c5da1\n [ffff9f799ddcbf50] ret_from_fork_nospec_begin at ffffffffa6d95ddd\n\nFix it by getting the needed CQE by calling mlx5_frag_buf_get_wqe() that\ntakes the correct source buffer as a parameter." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is mlx5 kernel CQ resize via ib_resize_cq()/mlx5_ib_resize_cq with udata==NULL, reached from local RDMA ULP connection setup, not from unauthenticated remote packet processing.\nAC:L - Enlarging a kernel CQ reliably exercises the buggy init loop; the attacker (or ULP acting on their behalf) chooses the larger entry count, with no race or attacker-uncontrollable condition required.\nPR:L - In the realistic deployment shown by the crash (RDMA ULP calling ib_resize_cq during client connection setup), unprivileged local workloads can drive that connection path; uverbs devices are also world-accessible (0666), and when uncertain between PR:L and PR:H the higher severity applies.\nUI:N - No separate victim action is required; the attacker’s own local activity that causes kernel CQ enlargement triggers the bug.\nS:U - Impact is kernel memory corruption within the host kernel security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary issue.\nC:H - Out-of-bounds indexing of cq->buf.fbc.frags yields a corrupted pointer write into kernel memory; per guidance, exploitable memory corruption supports high confidentiality impact.\nI:H - This is an out-of-bounds write through an attacker-influenced frag index into kernel memory, which can be leveraged for integrity compromise and control-flow hijacking.\nA:H - The commit documents a kernel panic in init_cq_frag_buf when enlarging the CQ, which is high availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/hw/mlx5/cq.c" ], "versions": [ { "version": "388ca8be00370db132464e27f745b8a0add19fcb", "lessThan": "1ec2dcd680c71d0d36fa25638b327a468babd5c9", "status": "affected", "versionType": "git" }, { "version": "388ca8be00370db132464e27f745b8a0add19fcb", "lessThan": "e3ecd9c09fcc10cf6b2bc67e2990c397c40a8c26", "status": "affected", "versionType": "git" }, { "version": "388ca8be00370db132464e27f745b8a0add19fcb", "lessThan": "91f7fdc4cc10542ca1045c06aad23365f0d067e0", "status": "affected", "versionType": "git" }, { "version": "388ca8be00370db132464e27f745b8a0add19fcb", "lessThan": "3e670c54eda238cb8a1ea93538a79ae89285c1c4", "status": "affected", "versionType": "git" }, { "version": "388ca8be00370db132464e27f745b8a0add19fcb", "lessThan": "2ba0aa2feebda680ecfc3c552e867cf4d1b05a3a", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/hw/mlx5/cq.c" ], "versions": [ { "version": "4.17", "status": "affected" }, { "version": "0", "lessThan": "4.17", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.195", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.126", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.44", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.12.11", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "4.19.195" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.4.126" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.10.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.12.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1ec2dcd680c71d0d36fa25638b327a468babd5c9" }, { "url": "https://git.kernel.org/stable/c/e3ecd9c09fcc10cf6b2bc67e2990c397c40a8c26" }, { "url": "https://git.kernel.org/stable/c/91f7fdc4cc10542ca1045c06aad23365f0d067e0" }, { "url": "https://git.kernel.org/stable/c/3e670c54eda238cb8a1ea93538a79ae89285c1c4" }, { "url": "https://git.kernel.org/stable/c/2ba0aa2feebda680ecfc3c552e867cf4d1b05a3a" } ], "title": "IB/mlx5: Fix initializing CQ fragments buffer", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2021-47261", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-21T18:50:22.252363Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:14:42.110Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:07.928Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/1ec2dcd680c71d0d36fa25638b327a468babd5c9", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e3ecd9c09fcc10cf6b2bc67e2990c397c40a8c26", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/91f7fdc4cc10542ca1045c06aad23365f0d067e0", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/3e670c54eda238cb8a1ea93538a79ae89285c1c4", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/2ba0aa2feebda680ecfc3c552e867cf4d1b05a3a", "tags": [ "x_transferred" ] } ] } ] } }