CVE-2021-47076: RDMA/rxe: Return CQE error if invalid lkey was supplied
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Return CQE error if invalid lkey was supplied
RXE is missing update of WQE status in LOCALWRITE failures. This caused the following kernel panic if someone sent an atomic operation with an explicitly wrong lkey.
[leonro@vm ~]$ mkt test testatomicinvalidlkey (tests.testatomic.AtomicTest) ... WARNING: CPU: 5 PID: 263 at drivers/infiniband/sw/rxe/rxecomp.c:740 rxecompleter+0x1a6d/0x2e30 [rdmarxe] Modules linked in: crc32generic rdmarxe ip6udptunnel udptunnel rdmaucm rdmacm ibumad ibipoib iwcm ibcm mlx5ib ibuverbs ibcore mlx5core ptp ppscore CPU: 5 PID: 263 Comm: python3 Not tainted 5.13.0-rc1+ #2936 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:rxecompleter+0x1a6d/0x2e30 [rdmarxe] Code: 03 0f 8e 65 0e 00 00 3b 93 10 06 00 00 0f 84 82 0a 00 00 4c 89 ff 4c 89 44 24 38 e8 2d 74 a9 e1 4c 8b 44 24 38 e9 1c f5 ff ff <0f> 0b e9 0c e8 ff ff b8 05 00 00 00 41 bf 05 00 00 00 e9 ab e7 ff RSP: 0018:ffff8880158af090 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888016a78000 RCX: ffffffffa0cf1652 RDX: 1ffff9200004b442 RSI: 0000000000000004 RDI: ffffc9000025a210 RBP: dffffc0000000000 R08: 00000000ffffffea R09: ffff88801617740b R10: ffffed1002c2ee81 R11: 0000000000000007 R12: ffff88800f3b63e8 R13: ffff888016a78008 R14: ffffc9000025a180 R15: 000000000000000c FS: 00007f88b622a740(0000) GS:ffff88806d540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f88b5a1fa10 CR3: 000000000d848004 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rxedotask+0x130/0x230 [rdmarxe] rxercv+0xb11/0x1df0 [rdmarxe] rxeloopback+0x157/0x1e0 [rdmarxe] rxeresponder+0x5532/0x7620 [rdmarxe] rxedotask+0x130/0x230 [rdmarxe] rxercv+0x9c8/0x1df0 [rdmarxe] rxeloopback+0x157/0x1e0 [rdmarxe] rxerequester+0x1efd/0x58c0 [rdmarxe] rxedotask+0x130/0x230 [rdmarxe] rxepostsend+0x998/0x1860 [rdmarxe] ibuverbspostsend+0xd5f/0x1220 [ibuverbs] ibuverbswrite+0x847/0xc80 [ibuverbs] vfswrite+0x1c5/0x840 ksyswrite+0x176/0x1d0 dosyscall64+0x3f/0x80 entrySYSCALL64afterhwframe+0x44/0xae
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47076?
CVE-2021-47076 has been classified as a high severity vulnerability due to its potential to cause kernel panic.
How do I fix CVE-2021-47076?
To resolve CVE-2021-47076, update your Linux kernel to versions 5.13-rc1, 5.13-rc2, or any version above 5.12.7.
What systems are affected by CVE-2021-47076?
CVE-2021-47076 affects the Linux kernel versions from 4.8 to 5.12.7, including release candidates 5.13-rc1 and 5.13-rc2.
What impact does CVE-2021-47076 have on systems?
The impact of CVE-2021-47076 can result in a kernel panic when an atomic operation is executed with an invalid lkey.
Is there any workaround for CVE-2021-47076?
Currently, there are no documented workarounds for CVE-2021-47076; the best mitigation is to apply the relevant kernel updates.