In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/rxe: Fix UAF in ODP init error-handling path<\/p>\n
rxe_odp_mr_init_user() stores &umem_odp->umem in mr->umem before
\ncalling rxe_odp_init_pages(). If rxe_odp_init_pages() fails,
\nrxe_odp_mr_init_user() releases umem_odp and returns an error.<\/p>\n
rxe_reg_user_mr() then unwinds the error through rxe_cleanup(),
\nrxe_mr_cleanup(), ib_umem_release(mr->umem). There is an
\nIS_ERR_OR_NULL(umem) check at the start of ib_umem_release().
\nBut since mr->umem is NOT reset to NULL in the error handling
\npath of rxe_odp_mr_init_user(), the check passes and it reads
\nalready-freed fields like umem->is_dmabuf, causing UAF.<\/p>\n
Fix the UAF by clearing mr->umem after releasing the failed
\nODP umem so the MR cleanup path does not release it again.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/rxe: Fix UAF in ODP init error-handling path<\/p>\n
rxe_odp_mr_init_user() stores &umem_odp->umem in mr->umem before
\ncalling rxe_odp<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25832","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25832","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25832"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25832"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25832"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}