Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2024-47696— RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency

CVSS 7.5 · High EPSS 0.73% · P51

Possible ATT&CK Techniques 1AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 27

VendorProductVersion RangeStatus
LinuxLinuxd91d253c87fd1efece521ff2612078a35af673c6< da2708a19f45b4a7278adf523837c8db21d1e2b5affected
7f25f296fc9bd0435be14e89bf657cd615a23574< 29b3bbd912b8db86df7a3c180b910ccb621f5635affected
94ee7ff99b87435ec63211f632918dc7f44dac79< 2efe8da2ddbf873385b4bc55366d09350b408df6affected
557d035fe88d78dd51664f4dc0e1896c04c97cf6< da0392698c62397c19deb1b9e9bdf2fbb5a9420eaffected
dc8074b8901caabb97c2d353abd6b4e7fa5a59a5< a64f30db12bdc937c5108158d98c8eab1925c548affected
ff5bbbdee08287d75d72e65b72a2b76d9637892a< 8b7df76356d098f85f3bd2c7cf6fb43f531893d7affected
ee39384ee787e86e9db4efb843818ef0ea9cb8ae< c8b18a75282cfd27822a8cc3c1f005c1ac8d1a58affected
aee2424246f9f1dadc33faa78990c1e2eb7826e4< a09dc967b3c58899e259c0aea092f421d22a0b04affected
… +19 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-47696

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency In the commit aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs"), the function flush_workqueue is invoked to flush the work queue iwcm_wq. But at that time, the work queue iwcm_wq was created via the function alloc_ordered_workqueue without the flag WQ_MEM_RECLAIM. Because the current process is trying to flush the whole iwcm_wq, if iwcm_wq doesn't have the flag WQ_MEM_RECLAIM, verify that the current process is not reclaiming memory or running on a workqueue which doesn't have the flag WQ_MEM_RECLAIM as that can break forward-progress guarantee leading to a deadlock. The call trace is as below: [ 125.350876][ T1430] Call Trace: [ 125.356281][ T1430] <TASK> [ 125.361285][ T1430] ? __warn (kernel/panic.c:693) [ 125.367640][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.375689][ T1430] ? report_bug (lib/bug.c:180 lib/bug.c:219) [ 125.382505][ T1430] ? handle_bug (arch/x86/kernel/traps.c:239) [ 125.388987][ T1430] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) [ 125.395831][ T1430] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621) [ 125.403125][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.410984][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.418764][ T1430] __flush_workqueue (kernel/workqueue.c:3970) [ 125.426021][ T1430] ? __pfx___might_resched (kernel/sched/core.c:10151) [ 125.433431][ T1430] ? destroy_cm_id (drivers/infiniband/core/iwcm.c:375) iw_cm [ 125.441209][ T1430] ? __pfx___flush_workqueue (kernel/workqueue.c:3910) [ 125.473900][ T1430] ? _raw_spin_lock_irqsave (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162) [ 125.473909][ T1430] ? __pfx__raw_spin_lock_irqsave (kernel/locking/spinlock.c:161) [ 125.482537][ T1430] _destroy_id (drivers/infiniband/core/cma.c:2044) rdma_cm [ 125.495072][ T1430] nvme_rdma_free_queue (drivers/nvme/host/rdma.c:656 drivers/nvme/host/rdma.c:650) nvme_rdma [ 125.505827][ T1430] nvme_rdma_reset_ctrl_work (drivers/nvme/host/rdma.c:2180) nvme_rdma [ 125.505831][ T1430] process_one_work (kernel/workqueue.c:3231) [ 125.515122][ T1430] worker_thread (kernel/workqueue.c:3306 kernel/workqueue.c:3393) [ 125.515127][ T1430] ? __pfx_worker_thread (kernel/workqueue.c:3339) [ 125.531837][ T1430] kthread (kernel/kthread.c:389) [ 125.539864][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.550628][ T1430] ret_from_fork (arch/x86/kernel/process.c:147) [ 125.558840][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.558844][ T1430] ret_from_fork_asm (arch/x86/entry/entry_64.S:257) [ 125.566487][ T1430] </TASK> [ 125.566488][ T1430] ---[ end trace 0000000000000000 ]---
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于RDMA/iwcm组件在flush_workqueue调用时的依赖性检查问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux d91d253c87fd1efece521ff2612078a35af673c6 ~ da2708a19f45b4a7278adf523837c8db21d1e2b5 -
LinuxLinux 6.11 -

II. Public POCs for CVE-2024-47696

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-47696

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-47696 (2)

Same Patch Batch · Linux · 2024-10-21 · 372 CVEs total

CVE-2022-489859.8 CRITICALnet: mana: Fix race on per-CQ variable napi work_done
CVE-2024-498559.8 CRITICALnbd: fix race between timeout and normal completion
CVE-2024-500339.8 CRITICALslip: make slhc_remember() more robust against malicious packets
CVE-2024-476959.8 CRITICALRDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
CVE-2022-490039.8 CRITICALnvme: fix SRCU protection of nvme_ns_head list
CVE-2024-500469.8 CRITICALNFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
CVE-2024-500479.8 CRITICALsmb: client: fix UAF in async decryption
CVE-2024-500439.8 CRITICALnfsd: fix possible badness in FREE_STATEID
CVE-2024-499969.4 CRITICALcifs: Fix buffer overflow when parsing NFS reparse points
CVE-2024-476789.4 CRITICALicmp: change the order of rate limits
CVE-2024-499508.8 HIGHBluetooth: L2CAP: Fix uaf in l2cap_connect
CVE-2024-499368.8 HIGHnet/xen-netback: prevent UAF in xenvif_flush_hash()
CVE-2022-490178.8 HIGHtipc: re-fetch skb cb after tipc_msg_validate
CVE-2022-490158.8 HIGHnet: hsr: Fix potential use-after-free
CVE-2024-499398.8 HIGHwifi: rtw89: avoid to add interface to list twice when SER
CVE-2024-500418.8 HIGHi40e: Fix macvlan leak by synchronizing access to mac_filter_hash
CVE-2024-499308.8 HIGHwifi: ath11k: fix array out-of-bound access in SoC stats
CVE-2022-489678.8 HIGHNFC: nci: Bounds check struct nfc_target arrays
CVE-2022-489648.8 HIGHravb: Fix potential use-after-free in ravb_rx_gbeth()
CVE-2022-489628.8 HIGHnet: hisilicon: Fix potential use-after-free in hisi_femac_rx()

Showing top 20 of 372 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-47696

No comments yet

Leave a comment