243 lines
14 KiB
JSON
243 lines
14 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-99212",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-25T10:25:14.401Z",
|
|
"datePublished": "2026-10-28T10:36:05.612Z",
|
|
"dateUpdated": "2026-10-31T12:45:05.538Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-31T12:45:05.538Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: don't let the rdma_cm destroy an id RDS still owns on route failure\n\nrds_rdma_cm_event_handler_cmn() hands the return value of\nrdma_resolve_route() straight back to the rdma_cm on\nRDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM\nfrom the route work allocation, an SA query that cannot be set up, a\nRoCE route with no usable device - makes addr_handler() destroy the\nid the event was delivered on. That id is ic->i_cm_id, and nothing\nclears the pointer: the connection sits in RDS_CONN_CONNECTING with a\nfreed id until its shutdown calls rdma_disconnect() and\nrdma_destroy_id() on it.\n\nThe ROUTE_RESOLVED case already avoids this: rds_ib_cm_initiate_connect()\nforces a zero return while ic->i_cm_id == cm_id, as the comment there\nexplains. Do the same here - drop the connection and return 0 - so\nthe id stays RDS's to destroy from the shutdown, and the reconnect\ngets a fresh one."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - An unprivileged process reaches patched rds_rdma_cm_event_handler_cmn() through AF_RDS sendmsg() → rds_connect_worker() → rds_ib_conn_path_connect() → addr_handler(). The failure occurs in local rdma_resolve_route() setup before any RDS message reaches a peer; no remote protocol message carries the trigger.\nAC:H - The synchronous error requires cma_resolve_ib_route() allocation/SA setup failure or cma_resolve_iboe_route() finding no usable netdevice or MTU. Choosing an RDS destination cannot reliably create those allocator, fabric-manager, or device states; an ordinary unreachable peer instead fails outside this ownership-error path.\nPR:L - rds_create(), rds_bind(), and rds_sendmsg() contain no capability check, and rds_ib_laddr_check() requires init_net but not root. Thus an ordinary host user can bind a configured IB/RoCE address and initiate the affected connection.\nUI:N - The attacker performs the AF_RDS sendmsg() themselves and can subsequently use RDS_CMSG_RDMA_MAP to reach __rds_rdma_map() → rds_ib_get_mr(), which dereferences the stale ic->i_cm_id. No victim action is required.\nS:U - The freed rdma_id_private and subsequent stale-pointer operations remain within the host kernel's RDS/RDMA security authority; no VM, IOMMU, or other distinct boundary is crossed.\nC:H - addr_handler() frees rdma_id_private while ic->i_cm_id retains its address, and rds_ib_get_mr() later reads qp from that reclaimed object. This kernel heap UAF permits controlled slab reuse and can be leveraged for arbitrary memory disclosure.\nI:H - If the reclaimed i_cm_id supplies a non-NULL qp, rds_ib_post_reg_frmr() passes it to ib_post_send(), reaching device operations through freed data; shutdown also calls rdma_disconnect() and rdma_destroy_id() on the stale ID. These provide control-flow and double-free corruption primitives.\nA:H - rds_ib_get_mr() can oops while reading ic->i_cm_id->qp, while rds_ib_conn_path_shutdown() later disconnects and destroys the already-freed ID. Either UAF path can panic the kernel."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/rds/rdma_transport.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
|
|
"lessThan": "664fd3205cbec71ac52c005ee705cd917bb6fb1a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
|
|
"lessThan": "b8f141f65885810e24fc23b8a71692db62d535bf",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
|
|
"lessThan": "e677eda15df7d5ce256654343418043c7ffd6f9b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
|
|
"lessThan": "92143c5d80382588d5a3047a4f14023ee9ef6485",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
|
|
"lessThan": "a7c7d0ff876377fea7ae876a28d6df8d9349df57",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
|
|
"lessThan": "91ece3efa064f0b3b3c67b9b045d9eeb4a034e43",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
|
|
"lessThan": "98d446b7c013254a8a7b49720557676a3a851fde",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/rds/rdma_transport.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2.6.30",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "2.6.30",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.224",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.191",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.161",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.115",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.59",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.13",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "5.15.224"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "6.1.191"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "6.6.161"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "6.12.115"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "6.18.59"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "7.2.13"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/664fd3205cbec71ac52c005ee705cd917bb6fb1a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b8f141f65885810e24fc23b8a71692db62d535bf"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e677eda15df7d5ce256654343418043c7ffd6f9b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/92143c5d80382588d5a3047a4f14023ee9ef6485"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a7c7d0ff876377fea7ae876a28d6df8d9349df57"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/91ece3efa064f0b3b3c67b9b045d9eeb4a034e43"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/98d446b7c013254a8a7b49720557676a3a851fde"
|
|
}
|
|
],
|
|
"title": "net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |