In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
rds: ib: Clear the sg list when mapping an MR fails<\/p>\n
rds_ib_map_frmr() stores the caller’s scatterlist in the MR before DMA
\nmapping and registration can fail. On failure, __rds_rdma_map() unpins
\nthe pages and frees the scatterlist, but rds_ib_free_frmr() can still
\nreturn the MR to the pool with the stale pointer set.<\/p>\n
This leaves the pool with a dangling scatterlist and can lead to local
\nprivilege escalation. KASAN detects the resulting use-after-free when the
\nMR is later torn down:<\/p>\n
BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr
\nRead of size 8<\/p>\n
Call Trace:
\n __rds_ib_teardown_mr
\n rds_ib_unreg_frmr
\n rds_ib_flush_mr_pool
\n rds_ib_flush_mrs
\n rds_free_mr
\n rds_setsockopt<\/p>\n
Store the scatterlist in the MR only after DMA mapping succeeds. If DMA
\nmapping fails, return directly while the MR fields remain clear; the caller
\nkeeps ownership of the scatterlist and its pinned pages. If a later
\nregistration step fails, unmap the scatterlist and clear the MR fields
\nbefore returning.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
rds: ib: Clear the sg list when mapping an MR fails<\/p>\n
rds_ib_map_frmr() stores the caller’s scatterlist in the MR before DMA
\nmapping<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40996","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40996","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40996"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40996"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}