Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-47197— net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于函数mlx5_debug_cq_remove存在安全漏洞。

CVSS 7.8 · High EPSS 0.24% · P14

Affected Version Matrix 11

VendorProduct Version RangeStatus
Linux Linux 4f7bddf8c5c01cac74373443b13a68e1c6723a94< 471c492890557bd58f73314bb4ad85d5a8fd5026 affected
94b960b9deffc02fc0747afc01f72cc62ab099e3< 2ae38157080616a13a9fe3f0b4b6ec0070aa408a affected
94b960b9deffc02fc0747afc01f72cc62ab099e3< 76ded29d3fcda4928da8849ffc446ea46871c1c2 affected
ed8aafea4fec9c654e63445236e0b505e27ed3a7 affected
5.10.75< 5.10.82 affected
5.14.14< 5.15 affected
5.15 affected
< 5.15 unaffected
… +3 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-47197

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() Prior to this patch in case mlx5_core_destroy_cq() failed it proceeds to rest of destroy operations. mlx5_core_destroy_cq() could be called again by user and cause additional call of mlx5_debug_cq_remove(). cq->dbg was not nullify in previous call and cause the crash. Fix it by nullify cq->dbg pointer after removal. Also proceed to destroy operations only if FW return 0 for MLX5_CMD_OP_DESTROY_CQ command. general protection fault, probably for non-canonical address 0x2000300004058: 0000 [#1] SMP PTI CPU: 5 PID: 1228 Comm: python Not tainted 5.15.0-rc5_for_upstream_min_debug_2021_10_14_11_06 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:lockref_get+0x1/0x60 Code: 5d e9 53 ff ff ff 48 8d 7f 70 e8 0a 2e 48 00 c7 85 d0 00 00 00 02 00 00 00 c6 45 70 00 fb 5d c3 c3 cc cc cc cc cc cc cc cc 53 <48> 8b 17 48 89 fb 85 d2 75 3d 48 89 d0 bf 64 00 00 00 48 89 c1 48 RSP: 0018:ffff888137dd7a38 EFLAGS: 00010206 RAX: 0000000000000000 RBX: ffff888107d5f458 RCX: 00000000fffffffe RDX: 000000000002c2b0 RSI: ffffffff8155e2e0 RDI: 0002000300004058 RBP: ffff888137dd7a88 R08: 0002000300004058 R09: ffff8881144a9f88 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881141d4000 R13: ffff888137dd7c68 R14: ffff888137dd7d58 R15: ffff888137dd7cc0 FS: 00007f4644f2a4c0(0000) GS:ffff8887a2d40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b4500f4380 CR3: 0000000114f7a003 CR4: 0000000000170ea0 Call Trace: simple_recursive_removal+0x33/0x2e0 ? debugfs_remove+0x60/0x60 debugfs_remove+0x40/0x60 mlx5_debug_cq_remove+0x32/0x70 [mlx5_core] mlx5_core_destroy_cq+0x41/0x1d0 [mlx5_core] devx_obj_cleanup+0x151/0x330 [mlx5_ib] ? __pollwait+0xd0/0xd0 ? xas_load+0x5/0x70 ? xa_load+0x62/0xa0 destroy_hw_idr_uobject+0x20/0x80 [ib_uverbs] uverbs_destroy_uobject+0x3b/0x360 [ib_uverbs] uobj_destroy+0x54/0xa0 [ib_uverbs] ib_uverbs_cmd_verbs+0xaf2/0x1160 [ib_uverbs] ? uverbs_finalize_object+0xd0/0xd0 [ib_uverbs] ib_uverbs_ioctl+0xc4/0x1b0 [ib_uverbs] __x64_sys_ioctl+0x3e4/0x8e0
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于函数mlx5_debug_cq_remove存在安全漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 4f7bddf8c5c01cac74373443b13a68e1c6723a94 ~ 471c492890557bd58f73314bb4ad85d5a8fd5026 -
Linux Linux 5.15 -

II. Public POCs for CVE-2021-47197

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-47197

请登录查看更多情报信息。

Other References for CVE-2021-47197 (3)

Same Patch Batch · Linux · 2024-04-10 · 39 CVEs total

CVE-2021-47215 9.8 CRITICAL net/mlx5e: kTLS, Fix crash in RX resync flow
CVE-2021-47203 8.8 HIGH scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
CVE-2021-47183 8.8 HIGH scsi: lpfc: Fix link down processing to address NULL pointer dereference
CVE-2021-47184 8.8 HIGH i40e: Fix NULL ptr dereference on VSI filter sync
CVE-2021-47201 7.8 HIGH iavf: free q_vectors before queues in iavf_disable_vf
CVE-2021-47200 7.8 HIGH drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
CVE-2024-26815 7.8 HIGH net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check
CVE-2021-47196 7.8 HIGH RDMA/core: Set send and receive CQ before forwarding to the driver
CVE-2021-47188 7.8 HIGH scsi: ufs: core: Improve SCSI abort handling
CVE-2021-47189 7.8 HIGH btrfs: fix memory ordering between normal and ordered work functions
CVE-2021-47209 7.8 HIGH sched/fair: Prevent dead task groups from regaining cfs_rq's
CVE-2021-47194 7.8 HIGH cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
CVE-2021-47219 7.1 HIGH scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
CVE-2021-47191 7.1 HIGH scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
CVE-2021-47211 ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
CVE-2021-47210 usb: typec: tipd: Remove WARN_ON in tps6598x_block_read
CVE-2021-47212 net/mlx5: Update error handler for UCTX and UMEM
CVE-2021-47214 hugetlb, userfaultfd: fix reservation restore on userfaultfd error
CVE-2021-47207 ALSA: gus: fix null pointer dereference on pointer block
CVE-2021-47216 scsi: advansys: Fix kernel pointer leak

Showing top 20 of 39 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47197

No comments yet

Leave a comment