SB20240531177 - Use-after-free in Linux kernel ulp rtrs driver
Published: May 31, 2024 Updated: May 14, 2025
Security Bulletin ID
SB20240531177
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2021-47026)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the rtrs_clt_remove_path_from_sysfs() function in drivers/infiniband/ulp/rtrs/rtrs-clt.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/b64415c6b3476cf9fa4d0aea3807065b8403a937
- https://git.kernel.org/stable/c/676171f9405dcaa45a33d18241c32f387dbaae39
- https://git.kernel.org/stable/c/d3cca8067d43dfee4a3535c645b55f618708dccb
- https://git.kernel.org/stable/c/7f4a8592ff29f19c5a2ca549d0973821319afaad
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.37
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.21
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.4
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13