CVE-2024-47695 RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
An out-of-bounds memory access in the Linux kernel RDMA client cleanup path can lead to memory corruption, potentially causing crashes or arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47695?
CVE-2024-47695 is a critical memory corruption vulnerability in Linux kernel, published on 21 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
In the function init_conns(), after the create_con() and create_cm() for loop if something fails. In the cleanup for loop after the destroy tag, we access out of bound memory because cid is set to clt_path->s.con_num.
This commits resets the cid to clt_path->s.con_num - 1, to stay in bounds in the cleanup loop later.
Weakness: CWE-787
Which versions are affected by CVE-2024-47695?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-47695?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-47695 being exploited?
There is no known exploitation of CVE-2024-47695 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-50727, AZL-50990, BELL-CVE-2024-47695, DEBIAN-CVE-2024-47695, GHSA-rrxr-8q8w-wpgf, ROOT-OS-DEBIAN-11-CVE-2024-47695 and 1 more.