Critical Vulnerability in Linux Kernel: RDMA/hns Invalid Pointer Access
Summary
DEBIAN-CVE-2024-57935: In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix accessing invalid dip_ctx during destroying QP If it fails to modify QP to RTR, dip_ctx will not be attached. Affects linux versions < 6.12.9-1. Fixed in 6.12.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and security features. However, like any complex software, it is susceptible to vulnerabilities that can compromise system integrity. This specific vulnerability affects the RDMA/hns subsystem, which is responsible for remote direct memory access, allowing efficient data transfer between computers.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the RDMA/hns subsystem where an invalid dip_ctx pointer may be accessed during the destruction of a Queue Pair (QP). If the modification of the QP to the Ready-to-Receive (RTR) state fails, the dip_ctx will not be attached, leading to potential access of an invalid pointer. This can result in undefined behavior, including system crashes or data corruption, posing a significant risk to system stability and security.
How To Fix
Minimum fixed version
6.12.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate any risks.
Conclusion
The RDMA/hns vulnerability in the Linux kernel poses a significant risk due to the potential for accessing invalid pointers, which can lead to system instability. It is crucial for users to update their systems to the patched version to mitigate these risks and ensure the security of their environments.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves accessing an invalid dip_ctx pointer during the destruction of a Queue Pair in the RDMA/hns subsystem of the Linux kernel.
The consequences may include system crashes, data corruption, or other undefined behaviors that could compromise system stability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, the vulnerability has been patched in version 6.12.9-1 of the Linux package for both Debian 13 and Debian 14.
You should update your Linux package to the patched version using the command: sudo apt-get update && sudo apt-get install linux=6.12.9-1.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
