CVE-2021-47012

HighCVSS 7.8/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix a use after free in siw_alloc_mr

Our code analyzer reported a UAF.

In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a freed object. After, the execution continue up to the err_out branch of siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr).

My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {} section, to avoid the uaf.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 2251334dcac9eb337575d8767e2a6a7e81848f7f, < 30b9e92d0b5e5d5dc1101ab856c17009537cbca4; >= 2251334dcac9eb337575d8767e2a6a7e81848f7f, < 608a4b90ece039940e9425ee2b39c8beff27e00c; >= 2251334dcac9eb337575d8767e2a6a7e81848f7f, < 3e22b88e02c194f6c80867abfef5cc09383461f4; >= 2251334dcac9eb337575d8767e2a6a7e81848f7f, < ad9ce7188432650469a6c7625bf479f5ed0b6155; >= 2251334dcac9eb337575d8767e2a6a7e81848f7f, < 3093ee182f01689b89e9f8797b321603e5de4f63
LinuxLinux5.3

References

Timeline

Published
Feb 28, 2024
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-470137.8In the Linux kernel, the following vulnerability has been resolved: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send In emaCVE-2021-470147.8In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix wild memory access when clearing fragments whilCVE-2021-470155.5In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RX consumer index logic in the error path. In bnxt_rx_pktCVE-2021-470165.5In the Linux kernel, the following vulnerability has been resolved: m68k: mvme147,mvme16x: Don't wipe PCC timer config bits Don't clear thCVE-2021-470177.8In the Linux kernel, the following vulnerability has been resolved: ath10k: Fix a use after free in ath10k_htc_send_bundle In ath10k_htc_sCVE-2021-470185.5In the Linux kernel, the following vulnerability has been resolved: powerpc/64: Fix the definition of the fixmap area At the time being, tCVE-2021-470195.5In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix possible invalid register access Disable the interruCVE-2021-470205.5In the Linux kernel, the following vulnerability has been resolved: soundwire: stream: fix memory leak in stream config error path When stCVE-2021-470215.5In the Linux kernel, the following vulnerability has been resolved: mt76: mt7915: fix memleak when mt7915_unregister_device() mt7915_tx_toCVE-2021-470225.5In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: fix memleak when mt7615_unregister_device() mt7615_tx_toCVE-2021-470238.2In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix port event handling on init For some reasoCVE-2021-470245.5In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: free queued packets when closing socket As reported by s
CVE-2021-47012: High severity, CVSS 7.8 | Vulnix