CVE-2024-38544 RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
A use-after-free in the Linux kernel RDMA driver allows attackers to cause a segmentation fault and system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38544?
CVE-2024-38544 is a critical use after free vulnerability in Linux kernel, published on 19 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
In rxe_comp_queue_pkt() an incoming response packet skb is enqueued to the resp_pkts queue and then a decision is made whether to run the completer task inline or schedule it. Finally the skb is dereferenced to bump a 'hw' performance counter. This is wrong because if the completer task is already running in a separate thread it may have already processed the skb and freed it which can cause a seg fault. This has been observed infrequently in testing at high scale.
This patch fixes this by changing the order of enqueuing the packet until after the counter is accessed.
Weakness: CWE-416
Which versions are affected by CVE-2024-38544?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-38544?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-38544 being exploited?
There is no known exploitation of CVE-2024-38544 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-38544, DEBIAN-CVE-2024-38544, GHSA-mqxf-7jx4-2h8p, UBUNTU-CVE-2024-38544.