CVE-2024-47750 — RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08 Currently rsv_qp is freed before ib_unregister_device() is …
Published: 2024-10-21 · CVSS: 7.8 · CVSS 3.1
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08 Currently rsv_qp is freed before ib_unregister_device() is called on HIP08. During the time interval, users can still dereg MR and rsv_qp will be used in this process, leading to a UAF. Move the release of rsv_qp after calling ib_unregister_device() to fix it.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7