|
Vulnerabilities
< Back

CVE-2024-35902

Updated on 19 May 2024

Severity

5.5 Medium severity

Details

CVSS score
5.5
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

net/rds: fix possible cp null dereference

cp might be null, calling cp->cp_conn would produce null dereference

[Simon Horman adds:]

Analysis:

  • cp is a parameter of __rds_rdma_map and is not reassigned.

  • The following call-sites pass a NULL cp argument to __rds_rdma_map()

  • rds_get_mr()
  • rds_get_mr_for_dest
  • Prior to the code above, the following assumes that cp may be NULL (which is indicative, but could itself be unnecessary)

trans_private = rs->rs_transport->get_mr( sg, nents, rs, &mr->r_key, cp ? cp->cp_conn : NULL, args->vec.addr, args->vec.bytes, need_odp ? ODP_ZEROBASED : ODP_NOT_NEEDED);

  • The code modified by this patch is guarded by IS_ERR(trans_private), where trans_private is assigned as per the previous point in this analysis.

The only implementation of get_mr that I could locate is rds_ib_get_mr() which can return an ERR_PTR if the conn (4th) argument is NULL.

  • ret is set to PTR_ERR(trans_private). rds_ib_get_mr can return ERR_PTR(-ENODEV) if the conn (4th) argument is NULL. Thus ret may be -ENODEV in which case the code in question will execute.

Conclusion:

  • cp may be NULL at the point where this patch adds a check; this patch does seem to address a possible bug

Details

Affected product:
Ubuntu 16.04 ELS , Ubuntu 18.04 ELS
Affected packages:
linux-hwe @ 4.15.0 (+1 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Debian 10 Will Not Fix —
Debian 10 cloud Will Not Fix —
Proxmox VE 7 5.15 Released
45 kernels
  • 5.15.102-1-pve-5.15.102-1
  • 5.15.104-1-pve-5.15.104-1
  • 5.15.104-1-pve-5.15.104-2
  • 5.15.107-1-pve-5.15.107-1
  • 5.15.107-2-pve-5.15.107-2
  • 5.15.108-1-pve-5.15.108-1
  • 5.15.108-1-pve-5.15.108-2
  • 5.15.116-1-pve-5.15.116-1
  • 5.15.12-1-pve-5.15.12-2
  • 5.15.12-1-pve-5.15.12-3
  • 5.15.126-1-pve-5.15.126-1
  • 5.15.131-1-pve-5.15.131-1
  • 5.15.131-1-pve-5.15.131-2
  • 5.15.131-2-pve-5.15.131-3
  • 5.15.136-1-pve-5.15.136-1
  • 5.15.17-1-pve-5.15.17-1
  • 5.15.19-1-pve-5.15.19-1
  • 5.15.19-2-pve-5.15.19-2
  • 5.15.19-2-pve-5.15.19-3
  • 5.15.27-1-pve-5.15.27-1
  • 5.15.30-1-pve-5.15.30-1
  • 5.15.30-2-pve-5.15.30-3
  • 5.15.35-1-pve-5.15.35-1
  • 5.15.35-1-pve-5.15.35-2
  • 5.15.35-1-pve-5.15.35-3
  • 5.15.35-2-pve-5.15.35-4
  • 5.15.35-2-pve-5.15.35-5
  • 5.15.35-3-pve-5.15.35-6
  • 5.15.39-1-pve-5.15.39-1
  • 5.15.39-2-pve-5.15.39-2
  • 5.15.39-3-pve-5.15.39-3
  • 5.15.39-4-pve-5.15.39-4
  • 5.15.5-1-pve-5.15.5-1
  • 5.15.53-1-pve-5.15.53-1
  • 5.15.60-1-pve-5.15.60-1
  • 5.15.60-2-pve-5.15.60-2
  • 5.15.64-1-pve-5.15.64-1
  • 5.15.7-1-pve-5.15.7-1
  • 5.15.74-1-pve-5.15.74-1
  • 5.15.83-1-pve-5.15.83-1
  • 5.15.85-1-pve-5.15.85-1
  • 5.15.111-1-pve-5.15.111-1
  • 5.15.143-1-pve-5.15.143-1
  • 5.15.149-1-pve-5.15.149-1
  • 5.15.152-1-pve-5.15.152-1
Ubuntu 20.04 HWE AWS Released
41 kernels
  • 5.15.0-1014.18~20.04.1
  • 5.15.0-1015.19~20.04.1
  • 5.15.0-1017.21~20.04.1
  • 5.15.0-1018.22~20.04.1
  • 5.15.0-1019.23~20.04.1
  • 5.15.0-1020.24~20.04.1
  • 5.15.0-1021.25~20.04.1
  • 5.15.0-1022.26~20.04.1
  • 5.15.0-1023.27~20.04.1
  • 5.15.0-1026.30~20.04.2
  • 5.15.0-1027.31~20.04.1
  • 5.15.0-1028.32~20.04.1
  • 5.15.0-1030.34~20.04.1
  • 5.15.0-1031.35~20.04.1
  • 5.15.0-1033.37~20.04.1
  • 5.15.0-1034.38~20.04.1
  • 5.15.0-1035.39~20.04.1
  • 5.15.0-1036.40~20.04.1
  • 5.15.0-1037.41~20.04.1
  • 5.15.0-1038.43~20.04.1
  • 5.15.0-1039.44~20.04.1
  • 5.15.0-1040.45~20.04.1
  • 5.15.0-1041.46~20.04.1
  • 5.15.0-1043.48~20.04.1
  • 5.15.0-1044.49~20.04.1
  • 5.15.0-1045.50~20.04.1
  • 5.15.0-1047.52~20.04.1
  • 5.15.0-1048.53~20.04.1
  • 5.15.0-1049.54~20.04.1
  • 5.15.0-1050.55~20.04.1
  • 5.15.0-1051.56~20.04.1
  • 5.15.0-1052.57~20.04.1
  • 5.15.0-1053.58~20.04.1
  • 5.15.0-1055.60~20.04.1
  • 5.15.0-1056.61~20.04.1
  • 5.15.0-1057.63~20.04.1
  • 5.15.0-1058.64~20.04.1
  • 5.15.0-1061.67~20.04.1
  • 5.15.0-1062.68~20.04.1
  • 5.15.0-1063.69~20.04.1
  • 5.15.0-1064.70~20.04.1
Ubuntu 20.04 HWE Azure Released
25 kernels
  • 5.15.0-1008.9~20.04.1
  • 5.15.0-1013.16~20.04.1
  • 5.15.0-1014.17~20.04.1
  • 5.15.0-1017.20~20.04.1
  • 5.15.0-1019.24~20.04.1
  • 5.15.0-1020.25~20.04.1
  • 5.15.0-1021.26~20.04.1
  • 5.15.0-1022.27~20.04.1
  • 5.15.0-1023.29~20.04.1
  • 5.15.0-1024.30~20.04.1
  • 5.15.0-1029.36~20.04.1
  • 5.15.0-1034.41~20.04.1
  • 5.15.0-1049.56~20.04.1
  • 5.15.0-1050.57~20.04.1
  • 5.15.0-1054.62~20.04.1
  • 5.15.0-1056.64~20.04.1
  • 5.15.0-1057.65~20.04.1
  • 5.15.0-1058.66~20.04.2
  • 5.15.0-1059.67~20.04.1
  • 5.15.0-1060.69~20.04.1
  • 5.15.0-1061.70~20.04.1
  • 5.15.0-1063.72~20.04.1
  • 5.15.0-1064.73~20.04.1
  • 5.15.0-1065.74~20.04.1
  • 5.15.0-1067.76~20.04.1
Ubuntu 22.04 Released
54 kernels
  • 5.15.0-100.110
  • 5.15.0-40.43
  • 5.15.0-101.111
  • 5.15.0-102.112
  • 5.15.0-105.115
  • 5.15.0-106.116
  • 5.15.0-107.117
  • 5.15.0-112.122
  • 5.15.0-113.123
  • 5.15.0-41.44
  • 5.15.0-43.46
  • 5.15.0-25.25
  • 5.15.0-27.28
  • 5.15.0-28.29
  • 5.15.0-29.30
  • 5.15.0-30.31
  • 5.15.0-33.34
  • 5.15.0-35.36
  • 5.15.0-37.39
  • 5.15.0-39.42
  • 5.15.0-46.49
  • 5.15.0-47.51
  • 5.15.0-48.54
  • 5.15.0-50.56
  • 5.15.0-52.58
  • 5.15.0-53.59
  • 5.15.0-54.60
  • 5.15.0-56.62
  • 5.15.0-57.63
  • 5.15.0-58.64
  • 5.15.0-60.66
  • 5.15.0-67.74
  • 5.15.0-68.75
  • 5.15.0-69.76
  • 5.15.0-70.77
  • 5.15.0-71.78
  • 5.15.0-72.79
  • 5.15.0-73.80
  • 5.15.0-74.81
  • 5.15.0-75.82
  • 5.15.0-76.83
  • 5.15.0-78.85
  • 5.15.0-79.86
  • 5.15.0-82.91
  • 5.15.0-83.92
  • 5.15.0-84.93
  • 5.15.0-86.96
  • 5.15.0-87.97
  • 5.15.0-88.98
  • 5.15.0-89.99
  • 5.15.0-91.101
  • 5.15.0-92.102
  • 5.15.0-94.104
  • 5.15.0-97.107
Ubuntu 22.04 AWS Released
48 kernels
  • 5.15.0-1004.6
  • 5.15.0-1005.7
  • 5.15.0-1008.10
  • 5.15.0-1009.11
  • 5.15.0-1011.14
  • 5.15.0-1013.17
  • 5.15.0-1014.18
  • 5.15.0-1015.19
  • 5.15.0-1017.21
  • 5.15.0-1018.22
  • 5.15.0-1020.24
  • 5.15.0-1021.25
  • 5.15.0-1022.26
  • 5.15.0-1023.27
  • 5.15.0-1024.29
  • 5.15.0-1026.30
  • 5.15.0-1027.31
  • 5.15.0-1028.32
  • 5.15.0-1030.34
  • 5.15.0-1031.35
  • 5.15.0-1032.36
  • 5.15.0-1033.37
  • 5.15.0-1034.38
  • 5.15.0-1035.39
  • 5.15.0-1036.40
  • 5.15.0-1037.41
  • 5.15.0-1038.43
  • 5.15.0-1039.44
  • 5.15.0-1040.45
  • 5.15.0-1042.47
  • 5.15.0-1043.48
  • 5.15.0-1044.49
  • 5.15.0-1045.50
  • 5.15.0-1047.52
  • 5.15.0-1048.53
  • 5.15.0-1049.54
  • 5.15.0-1050.55
  • 5.15.0-1051.56
  • 5.15.0-1052.57
  • 5.15.0-1053.58
  • 5.15.0-1055.60
  • 5.15.0-1056.61
  • 5.15.0-1057.63
  • 5.15.0-1060.66
  • 5.15.0-1061.67
  • 5.15.0-1062.68
  • 5.15.0-1063.69
  • 5.15.0-1064.70
Ubuntu 22.04 Azure Released
45 kernels
  • 5.15.0-1003.4
  • 5.15.0-1005.6
  • 5.15.0-1007.8
  • 5.15.0-1008.9
  • 5.15.0-1010.12
  • 5.15.0-1012.15
  • 5.15.0-1013.16
  • 5.15.0-1014.17
  • 5.15.0-1017.20
  • 5.15.0-1019.24
  • 5.15.0-1020.25
  • 5.15.0-1021.26
  • 5.15.0-1022.27
  • 5.15.0-1023.29
  • 5.15.0-1024.30
  • 5.15.0-1029.36
  • 5.15.0-1034.41
  • 5.15.0-1035.42
  • 5.15.0-1036.43
  • 5.15.0-1037.44
  • 5.15.0-1038.45
  • 5.15.0-1039.46
  • 5.15.0-1040.47
  • 5.15.0-1041.48
  • 5.15.0-1042.49
  • 5.15.0-1044.51
  • 5.15.0-1045.52
  • 5.15.0-1046.53
  • 5.15.0-1047.54
  • 5.15.0-1049.56
  • 5.15.0-1050.57
  • 5.15.0-1051.59
  • 5.15.0-1052.60
  • 5.15.0-1053.61
  • 5.15.0-1054.62
  • 5.15.0-1056.64
  • 5.15.0-1057.65
  • 5.15.0-1058.66
  • 5.15.0-1059.67
  • 5.15.0-1060.69
  • 5.15.0-1061.70
  • 5.15.0-1063.72
  • 5.15.0-1064.73
  • 5.15.0-1066.75
  • 5.15.0-1067.76
Ubuntu 24.04 Planned —