{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-57857",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-57857"
  ],
  "published": "2025-01-15T13:11:32Z",
  "summary": "RDMA/siw: Remove direct link to net_device",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Remove direct link to net_device\n\nDo not manage a per device direct link to net_device. Rely\non associated ib_devices net_device management, not doubling\nthe effort locally. A badly managed local link to net_device\nwas causing a 'KASAN: slab-use-after-free' exception during\nsiw_query_port() call.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": null,
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-57857"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4eafeb4f021c50d13f199239d913b37de3c83135"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/16b87037b48889d21854c8e97aec8a1baf2642b3"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The dangling `sdev->netdev` is only dereferenced from local paths \u2014 sysfs port attribute reads, NETLINK_RDMA `PORT_GET`, uverbs `query_port`/`query_qp`, `rdma_listen()`, and the in-kernel ib_cache work triggered by local netdev teardown. No remote peer data or received packet reaches these sites.\nAC:L - The attacker drives both sides of the race \u2014 generating port events (netdev up/down/changeaddr) that queue the `ib_cache_event_task`, and tearing down the netdev/netns that frees the `net_device` \u2014 and can repeat the sequence indefinitely while spamming `query_port` via sysfs/netlink, so the window is reachable on demand (syzbot reproduced it).\nPR:L - The code that dereferences the freed pointer is reachable with zero privileges (world-readable `/sys/class/infiniband/*/ports/1/state`, unprivileged `RDMA_NLDEV_CMD_PORT_GET`, `ibv_query_port`), and the netdev-teardown side needs only `CAP_NET_ADMIN` within a network namespace, which an unprivileged user obtains via `unshare -Urn`; no real root in the initial namespace is required to reach the vulnerable dereference.\nUI:N - No victim action is needed \u2014 the attacker performs the device/netdev teardown and the query itself, or simply races the kernel's own asynchronous cache-update work.\nS:U - The use-after-free is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a use-after-free read of a freed `struct net_device` slab object whose contents can be groomed by the attacker, and the read values are returned to userspace through `attr->max_mtu`/`active_mtu` and `qp_attr->path_mtu`, giving a controllable read of reclaimed kernel memory.\nI:H - Per use-after-free handling, the dangling pointer is not merely read but its contents feed kernel state \u2014 `siw_create_listen()` writes freed memory into `sk->sk_bound_dev_if` \u2014 and a UAF on a sprayable slab object is the standard primitive for heap grooming and control-flow corruption.\nA:H - The confirmed outcome is a KASAN slab-use-after-free during `siw_query_port()`; dereferencing a stale `net_device` pointer into reclaimed or unmapped memory oopses/panics the kernel, and the trigger can be repeated at will."
    }
  }
}