Junglewise Threat Intelligence

CVE-2024-26872: Linux Kernel RDMA/srpt use-after-free in srpt_refresh_port

CVE-2024-26872 · Severity: high · CVSS 7 · Published 2024-04-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's SCSI RDMA Protocol (SRP) target driver, which is used for high-performance data transfers over network fabrics. A race condition during the initialization of RDMA devices can lead to a system crash or memory corruption. This could allow a local attacker with limited privileges to compromise the stability of the system or potentially gain unauthorized access to sensitive information.

Technical details

A use-after-free (UAF) vulnerability exists in the RDMA/srpt (SCSI RDMA Protocol Target) driver within the Linux kernel. The root cause is a race condition in the `srpt_add_one()` function, where `ib_register_event_handler()` is called before the SRPT device is fully configured. If an event occurs or an error happens during the remaining setup steps, a partially initialized event handler may be accessed, leading to a UAF write in `srpt_refresh_port()`. This is a local vulnerability requiring low privileges but high complexity (race condition). Attackers can achieve local privilege escalation or cause a denial of service. The issue has been patched by moving the event handler registration to the end of the initialization sequence.

Affected products

  • Linux Linux Kernel 3.3 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2

Timeline

  • 2024-02-02: other: Patch submitted by developer
  • 2024-04-17: disclosed: CVE published

References

Related threats