CVE-2024-50095— RDMA/mad: Improve handling of timed out WRs of mad agent
Affected Version Matrix 14
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 713adaf0ecfc49405f6e5d9e409d984f628de818 | affected |
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 7022a517bf1ca37ef5a474365bcc5eafd345a13a | affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< e80eadb3604a92d2d086e956b8b2692b699d4d0a | affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< a195a42dd25ca4f12489687065d00be64939409f | affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 3e799fa463508abe7a738ce5d0f62a8dfd05262a | affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 2a777679b8ccd09a9a65ea0716ef10365179caac | affected | ||
2.6.12 | affected | ||
< 2.6.12 | unaffected | ||
| … +6 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-50095
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RDMA/mad: Improve handling of timed out WRs of mad agent
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Improve handling of timed out WRs of mad agent Current timeout handler of mad agent acquires/releases mad_agent_priv lock for every timed out WRs. This causes heavy locking contention when higher no. of WRs are to be handled inside timeout handler. This leads to softlockup with below trace in some use cases where rdma-cm path is used to establish connection between peer nodes Trace: ----- BUG: soft lockup - CPU#4 stuck for 26s! [kworker/u128:3:19767] CPU: 4 PID: 19767 Comm: kworker/u128:3 Kdump: loaded Tainted: G OE ------- --- 5.14.0-427.13.1.el9_4.x86_64 #1 Hardware name: Dell Inc. PowerEdge R740/01YM03, BIOS 2.4.8 11/26/2019 Workqueue: ib_mad1 timeout_sends [ib_core] RIP: 0010:__do_softirq+0x78/0x2ac RSP: 0018:ffffb253449e4f98 EFLAGS: 00000246 RAX: 00000000ffffffff RBX: 0000000000000000 RCX: 000000000000001f RDX: 000000000000001d RSI: 000000003d1879ab RDI: fff363b66fd3a86b RBP: ffffb253604cbcd8 R08: 0000009065635f3b R09: 0000000000000000 R10: 0000000000000040 R11: ffffb253449e4ff8 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff8caa1fc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd9ec9db900 CR3: 0000000891934006 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? __irq_exit_rcu+0xa1/0xc0 ? watchdog_timer_fn+0x1b2/0x210 ? __pfx_watchdog_timer_fn+0x10/0x10 ? __hrtimer_run_queues+0x127/0x2c0 ? hrtimer_interrupt+0xfc/0x210 ? __sysvec_apic_timer_interrupt+0x5c/0x110 ? sysvec_apic_timer_interrupt+0x37/0x90 ? asm_sysvec_apic_timer_interrupt+0x16/0x20 ? __do_softirq+0x78/0x2ac ? __do_softirq+0x60/0x2ac __irq_exit_rcu+0xa1/0xc0 sysvec_call_function_single+0x72/0x90 </IRQ> <TASK> asm_sysvec_call_function_single+0x16/0x20 RIP: 0010:_raw_spin_unlock_irq+0x14/0x30 RSP: 0018:ffffb253604cbd88 EFLAGS: 00000247 RAX: 000000000001960d RBX: 0000000000000002 RCX: ffff8cad2a064800 RDX: 000000008020001b RSI: 0000000000000001 RDI: ffff8cad5d39f66c RBP: ffff8cad5d39f600 R08: 0000000000000001 R09: 0000000000000000 R10: ffff8caa443e0c00 R11: ffffb253604cbcd8 R12: ffff8cacb8682538 R13: 0000000000000005 R14: ffffb253604cbd90 R15: ffff8cad5d39f66c cm_process_send_error+0x122/0x1d0 [ib_cm] timeout_sends+0x1dd/0x270 [ib_core] process_one_work+0x1e2/0x3b0 ? __pfx_worker_thread+0x10/0x10 worker_thread+0x50/0x3a0 ? __pfx_worker_thread+0x10/0x10 kthread+0xdd/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x50 </TASK> Simplified timeout handler by creating local list of timed out WRs and invoke send handler post creating the list. The new method acquires/ releases lock once to fetch the list and hence helps to reduce locking contetiong when processing higher no. of WRs
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于RDMA/mad模块在处理超时的工作请求时未能正确处理锁争用，可能导致软锁定。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-50095
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-50095
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-50095 (2)
Same Patch Batch · Linux · 2024-11-05 · 50 CVEs total
| CVE-2024-50123 | bpf: Add the missing BPF_LINK_TYPE invocation for sockmap | |
| CVE-2024-50129 | net: pse-pd: Fix out of bound for loop | |
| CVE-2024-50134 | drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA | |
| CVE-2024-50136 | net/mlx5: Unregister notifier on eswitch init failure | |
| CVE-2024-50135 | nvme-pci: fix race condition between reset and nvme_dev_disable() | |
| CVE-2024-50137 | reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC | |
| CVE-2024-50138 | bpf: Use raw_spinlock_t in ringbuf | |
| CVE-2024-50132 | tracing/probes: Fix MAX_TRACE_ARGS limit handling | |
| CVE-2024-50127 | net: sched: fix use-after-free in taprio_change() | |
| CVE-2024-50125 | Bluetooth: SCO: Fix UAF on sco_sock_timeout | |
| CVE-2024-50126 | net: sched: use RCU read-side critical section in taprio_dump() | |
| CVE-2024-50124 | Bluetooth: ISO: Fix UAF on iso_sock_timeout | |
| CVE-2024-50121 | nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net | |
| CVE-2024-50122 | PCI: Hold rescan lock while adding devices during host probe | |
| CVE-2024-50120 | smb: client: Handle kstrdup failures for passwords | |
| CVE-2024-50119 | cifs: fix warning when destroy 'cifs_io_request_pool' | |
| CVE-2024-50118 | btrfs: reject ro->rw reconfiguration if there are hard ro requirements | |
| CVE-2024-50117 | drm/amd: Guard against bad data for ATIF ACPI method | |
| CVE-2024-50116 | nilfs2: fix kernel bug due to missing clearing of buffer delay flag | |
| CVE-2024-50115 | KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory |
Showing top 20 of 50 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2024-50095
No comments yet