{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-47750",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-47750"
  ],
  "published": "2024-10-21T12:16:24Z",
  "summary": "RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix Use-After-Free of rsv_qp on HIP08\n\nCurrently rsv_qp is freed before ib_unregister_device() is called\non HIP08. During the time interval, users can still dereg MR and\nrsv_qp will be used in this process, leading to a UAF. Move the\nrelease of rsv_qp after calling ib_unregister_device() to fix it.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.113",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47750"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2ccf1c75d39949d8ea043d04a2e92d7100ea723d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d2d9c5127122745da6e887f451dd248cfeffca33"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/dac2723d8bfa9cf5333f477741e6e5fa1ed34645"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/60595923371c2ebe7faf82536c47eb0c967e3425"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/fd8489294dd2beefb70f12ec4f6132aeec61a4d0"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerable code is reached by a local process issuing an MR deregistration on an RDMA verbs character device (/dev/infiniband/uverbs*, typically mode 0666 under stock rdma-core udev rules), i.e. via ioctl/write on a local device file. No remote packet processing reaches `free_mr_send_cmd_to_hw()`.\nAC:L - The attacker owns the consuming side of the race and can keep many threads permanently spinning in `ib_dereg_mr()`, so threads are continuously resident in the completely unsynchronized window between the `hr_dev->state` TOCTOU check and the dereference of `free_mr->rsv_qp[]`/`rsv_cq`; whenever the routine teardown or hardware reset path runs `free_mr_exit()`, the race is won reliably, and the freed `struct hns_roce_qp` is a plain kmalloc object the attacker can spray.\nPR:L - Only an ordinary unprivileged local account is needed \u2014 opening the uverbs device, allocating a PD and registering a small MR (within the default RLIMIT_MEMLOCK, so no CAP_IPC_LOCK), then deregistering it, is enough to enter `hns_roce_v2_dereg_mr()`. No root, CAP_NET_ADMIN, or capability in any namespace is required.\nUI:N - The attacker's own dereg-MR loop drives the vulnerable path entirely on its own; no victim action, file open, or mount is needed, and the teardown side is a routine system event rather than a user-performed step.\nS:U - The use-after-free corrupts kernel heap state within the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free on a heap-allocated `struct hns_roce_qp` and `struct hns_roce_cq`; after slab reallocation, `hns_roce_v2_post_send()` and `hns_roce_v2_poll_cq()` read pointers, MTR translation state, and CQE contents out of attacker-groomed memory, yielding an arbitrary kernel-memory read primitive.\nI:H - `hns_roce_v2_post_send()` writes a WQE and `qp->sq.wrid[wqe_idx]` through addresses computed from the freed object's fields and takes a spinlock on freed memory, so reclaiming the slab gives a controlled kernel write usable for control-flow hijack and privilege escalation; `mutex_lock()` on a `mutex_destroy()`ed lock compounds the corruption.\nA:H - Even without successful heap grooming, dereferencing the freed reserved QP/CQ and locking a destroyed mutex reliably produces a KASAN splat, list corruption, or kernel oops/panic, taking the RDMA-serving host down."
    }
  }
}