CVE-2024-38539

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-38539", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.918Z", "datePublished": "2024-06-19T13:35:14.099Z", "dateUpdated": "2026-08-05T11:32:38.596Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:38.596Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw\n\nWhen running blktests nvme/rdma, the following kmemleak issue will appear.\n\nkmemleak: Kernel memory leak detector initialized (mempool available:36041)\nkmemleak: Automatic memory scanning thread started\nkmemleak: 2 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nkmemleak: 8 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nkmemleak: 17 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nkmemleak: 4 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\n\nunreferenced object 0xffff88855da53400 (size 192):\n comm \"rdma\", pid 10630, jiffies 4296575922\n hex dump (first 32 bytes):\n 37 00 00 00 00 00 00 00 c0 ff ff ff 1f 00 00 00 7...............\n 10 34 a5 5d 85 88 ff ff 10 34 a5 5d 85 88 ff ff .4.].....4.]....\n backtrace (crc 47f66721):\n [<ffffffff911251bd>] kmalloc_trace+0x30d/0x3b0\n [<ffffffffc2640ff7>] alloc_gid_entry+0x47/0x380 [ib_core]\n [<ffffffffc2642206>] add_modify_gid+0x166/0x930 [ib_core]\n [<ffffffffc2643468>] ib_cache_update.part.0+0x6d8/0x910 [ib_core]\n [<ffffffffc2644e1a>] ib_cache_setup_one+0x24a/0x350 [ib_core]\n [<ffffffffc263949e>] ib_register_device+0x9e/0x3a0 [ib_core]\n [<ffffffffc2a3d389>] 0xffffffffc2a3d389\n [<ffffffffc2688cd8>] nldev_newlink+0x2b8/0x520 [ib_core]\n [<ffffffffc2645fe3>] rdma_nl_rcv_msg+0x2c3/0x520 [ib_core]\n [<ffffffffc264648c>]\nrdma_nl_rcv_skb.constprop.0.isra.0+0x23c/0x3a0 [ib_core]\n [<ffffffff9270e7b5>] netlink_unicast+0x445/0x710\n [<ffffffff9270f1f1>] netlink_sendmsg+0x761/0xc40\n [<ffffffff9249db29>] __sys_sendto+0x3a9/0x420\n [<ffffffff9249dc8c>] __x64_sys_sendto+0xdc/0x1b0\n [<ffffffff92db0ad3>] do_syscall_64+0x93/0x180\n [<ffffffff92e00126>] entry_SYSCALL_64_after_hwframe+0x71/0x79\n\nThe root cause: rdma_put_gid_attr is not called when sgid_attr is set\nto ERR_PTR(-ENODEV)."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The leaking call site is reached from `siw_proc_mpareq()`/`iw_conn_req_handler()` \u2192 `cma_iw_acquire_dev()` when a remote peer opens an iWARP MPA connection to any RDMA-CM listener (nvmet-rdma, NFS/RDMA, SMB Direct) over TCP. The attacker selects which local address, and therefore which `bound_dev_if`, the connection lands on.\nAC:L - No race, no memory-layout dependency and no timing window \u2014 the missing `rdma_put_gid_attr()` is hit deterministically whenever the GID entry's netdev ifindex or netns differs from the id's, and the attacker simply repeats connection attempts (or `bind()` calls locally).\nPR:N - `iw_conn_req_handler()` runs during MPA connect-request processing, before any ULP-level authentication or credential check. On the local path `ucma.c` contains no `capable()` check at all and `/dev/infiniband/rdma_cm` is mode 0666 under stock rdma-core udev rules.\nUI:N - The leak occurs entirely within kernel connection-establishment or bind handling; no action by any local user or administrator is needed.\nS:U - The leaked reference, the orphaned GID entry and the pinned netdevice all live in the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:N - A dropped `kref_put()` neither reads out-of-bounds nor exposes freed or uninitialized memory to the attacker, and no kernel address or data is returned on the error path.\nI:N - Nothing is written out of bounds or type-confused; `kref` is built on `refcount_t`, which saturates instead of wrapping, so the inflated count cannot be driven into a premature free or write primitive.\nA:H - The orphaned GID entry permanently retains its `dev_hold()`, so `unregister_netdevice()` loops forever (\"waiting for X to become free\") and wedges the global single-threaded `cleanup_net` workqueue, blocking all subsequent netns teardown. `release_gid_table()` also emits a `WARN_ONCE` GID-ref-leak splat, which is a panic on `panic_on_warn` systems."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/core/cma.c"], "versions": [{"version": "f8ef1be816bf9a0c406c696368c2264a9597a994", "lessThan": "3eb127dc408bf7959a4920d04d16ce10e863686a", "status": "affected", "versionType": "git"}, {"version": "f8ef1be816bf9a0c406c696368c2264a9597a994", "lessThan": "6564fc1818404254d1c9f7d75b403b4941516d26", "status": "affected", "versionType": "git"}, {"version": "f8ef1be816bf9a0c406c696368c2264a9597a994", "lessThan": "b3a7fb93afd888793ef226e9665fbda98a95c48e", "status": "affected", "versionType": "git"}, {"version": "f8ef1be816bf9a0c406c696368c2264a9597a994", "lessThan": "9c0731832d3b7420cbadba6a7f334363bc8dfb15", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/core/cma.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.12", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.3", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.8.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.9.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3eb127dc408bf7959a4920d04d16ce10e863686a"}, {"url": "https://git.kernel.org/stable/c/6564fc1818404254d1c9f7d75b403b4941516d26"}, {"url": "https://git.kernel.org/stable/c/b3a7fb93afd888793ef226e9665fbda98a95c48e"}, {"url": "https://git.kernel.org/stable/c/9c0731832d3b7420cbadba6a7f334363bc8dfb15"}], "title": "RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:25.210Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/3eb127dc408bf7959a4920d04d16ce10e863686a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6564fc1818404254d1c9f7d75b403b4941516d26", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b3a7fb93afd888793ef226e9665fbda98a95c48e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9c0731832d3b7420cbadba6a7f334363bc8dfb15", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38539", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:15:13.442238Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:58.137Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/3eb127dc408bf7959a4920d04d16ce10e863686a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6564fc1818404254d1c9f7d75b403b4941516d26", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b3a7fb93afd888793ef226e9665fbda98a95c48e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9c0731832d3b7420cbadba6a7f334363bc8dfb15", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:25.210Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38539", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:15:13.442238Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:27.236Z"}}], "cna": {"title": "RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f8ef1be816bf9a0c406c696368c2264a9597a994", "lessThan": "3eb127dc408bf7959a4920d04d16ce10e863686a", "versionType": "git"}, {"status": "affected", "version": "f8ef1be816bf9a0c406c696368c2264a9597a994", "lessThan": "6564fc1818404254d1c9f7d75b403b4941516d26", "versionType": "git"}, {"status": "affected", "version": "f8ef1be816bf9a0c406c696368c2264a9597a994", "lessThan": "b3a7fb93afd888793ef226e9665fbda98a95c48e", "versionType": "git"}, {"status": "affected", "version": "f8ef1be816bf9a0c406c696368c2264a9597a994", "lessThan": "9c0731832d3b7420cbadba6a7f334363bc8dfb15", "versionType": "git"}], "programFiles": ["drivers/infiniband/core/cma.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"status": "unaffected", "version": "0", "lessThan": "6.6", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.33", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.12", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9.3", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/core/cma.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3eb127dc408bf7959a4920d04d16ce10e863686a"}, {"url": "https://git.kernel.org/stable/c/6564fc1818404254d1c9f7d75b403b4941516d26"}, {"url": "https://git.kernel.org/stable/c/b3a7fb93afd888793ef226e9665fbda98a95c48e"}, {"url": "https://git.kernel.org/stable/c/9c0731832d3b7420cbadba6a7f334363bc8dfb15"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw\n\nWhen running blktests nvme/rdma, the following kmemleak issue will appear.\n\nkmemleak: Kernel memory leak detector initialized (mempool available:36041)\nkmemleak: Automatic memory scanning thread started\nkmemleak: 2 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nkmemleak: 8 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nkmemleak: 17 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nkmemleak: 4 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\n\nunreferenced object 0xffff88855da53400 (size 192):\n comm \"rdma\", pid 10630, jiffies 4296575922\n hex dump (first 32 bytes):\n 37 00 00 00 00 00 00 00 c0 ff ff ff 1f 00 00 00 7...............\n 10 34 a5 5d 85 88 ff ff 10 34 a5 5d 85 88 ff ff .4.].....4.]....\n backtrace (crc 47f66721):\n [<ffffffff911251bd>] kmalloc_trace+0x30d/0x3b0\n [<ffffffffc2640ff7>] alloc_gid_entry+0x47/0x380 [ib_core]\n [<ffffffffc2642206>] add_modify_gid+0x166/0x930 [ib_core]\n [<ffffffffc2643468>] ib_cache_update.part.0+0x6d8/0x910 [ib_core]\n [<ffffffffc2644e1a>] ib_cache_setup_one+0x24a/0x350 [ib_core]\n [<ffffffffc263949e>] ib_register_device+0x9e/0x3a0 [ib_core]\n [<ffffffffc2a3d389>] 0xffffffffc2a3d389\n [<ffffffffc2688cd8>] nldev_newlink+0x2b8/0x520 [ib_core]\n [<ffffffffc2645fe3>] rdma_nl_rcv_msg+0x2c3/0x520 [ib_core]\n [<ffffffffc264648c>]\nrdma_nl_rcv_skb.constprop.0.isra.0+0x23c/0x3a0 [ib_core]\n [<ffffffff9270e7b5>] netlink_unicast+0x445/0x710\n [<ffffffff9270f1f1>] netlink_sendmsg+0x761/0xc40\n [<ffffffff9249db29>] __sys_sendto+0x3a9/0x420\n [<ffffffff9249dc8c>] __x64_sys_sendto+0xdc/0x1b0\n [<ffffffff92db0ad3>] do_syscall_64+0x93/0x180\n [<ffffffff92e00126>] entry_SYSCALL_64_after_hwframe+0x71/0x79\n\nThe root cause: rdma_put_gid_attr is not called when sgid_attr is set\nto ERR_PTR(-ENODEV)."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.33", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.12", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.3", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "6.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T09:13:33.880Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38539", "state": "PUBLISHED", "dateUpdated": "2025-05-04T09:13:33.880Z", "dateReserved": "2024-06-18T19:36:34.918Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-19T13:35:14.099Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/core/cma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3eb127dc408bf7959a4920d04d16ce10e863686a", "status": "affected", "version": "f8ef1be816bf9a0c406c696368c2264a9597a994", "versionType": "git"}, {"lessThan": "6564fc1818404254d1c9f7d75b403b4941516d26", "status": "affected", "version": "f8ef1be816bf9a0c406c696368c2264a9597a994", "versionType": "git"}, {"lessThan": "b3a7fb93afd888793ef226e9665fbda98a95c48e", "status": "affected", "version": "f8ef1be816bf9a0c406c696368c2264a9597a994", "versionType": "git"}, {"lessThan": "9c0731832d3b7420cbadba6a7f334363bc8dfb15", "status": "affected", "version": "f8ef1be816bf9a0c406c696368c2264a9597a994", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/core/cma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.33", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.12", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "53BC60D9-65A5-4D8F-96C8-149F09214DBD", "versionEndExcluding": "6.6.33", "versionStartIncluding": "6.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "80550309-67AB-4FD1-AC07-3DED5C4F01B2", "versionEndExcluding": "6.8.12", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E07124C1-19E8-4D21-828D-9932A01D3011", "versionEndExcluding": "6.9.3", "versionStartIncluding": "6.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw\n\nWhen running blktests nvme/rdma, the following kmemleak issue will appear.\n\nkmemleak: Kernel memory leak detector initialized (mempool available:36041)\nkmemleak: Automatic memory scanning thread started\nkmemleak: 2 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nkmemleak: 8 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nkmemleak: 17 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nkmemleak: 4 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\n\nunreferenced object 0xffff88855da53400 (size 192):\n comm \"rdma\", pid 10630, jiffies 4296575922\n hex dump (first 32 bytes):\n 37 00 00 00 00 00 00 00 c0 ff ff ff 1f 00 00 00 7...............\n 10 34 a5 5d 85 88 ff ff 10 34 a5 5d 85 88 ff ff .4.].....4.]....\n backtrace (crc 47f66721):\n [<ffffffff911251bd>] kmalloc_trace+0x30d/0x3b0\n [<ffffffffc2640ff7>] alloc_gid_entry+0x47/0x380 [ib_core]\n [<ffffffffc2642206>] add_modify_gid+0x166/0x930 [ib_core]\n [<ffffffffc2643468>] ib_cache_update.part.0+0x6d8/0x910 [ib_core]\n [<ffffffffc2644e1a>] ib_cache_setup_one+0x24a/0x350 [ib_core]\n [<ffffffffc263949e>] ib_register_device+0x9e/0x3a0 [ib_core]\n [<ffffffffc2a3d389>] 0xffffffffc2a3d389\n [<ffffffffc2688cd8>] nldev_newlink+0x2b8/0x520 [ib_core]\n [<ffffffffc2645fe3>] rdma_nl_rcv_msg+0x2c3/0x520 [ib_core]\n [<ffffffffc264648c>]\nrdma_nl_rcv_skb.constprop.0.isra.0+0x23c/0x3a0 [ib_core]\n [<ffffffff9270e7b5>] netlink_unicast+0x445/0x710\n [<ffffffff9270f1f1>] netlink_sendmsg+0x761/0xc40\n [<ffffffff9249db29>] __sys_sendto+0x3a9/0x420\n [<ffffffff9249dc8c>] __x64_sys_sendto+0xdc/0x1b0\n [<ffffffff92db0ad3>] do_syscall_64+0x93/0x180\n [<ffffffff92e00126>] entry_SYSCALL_64_after_hwframe+0x71/0x79\n\nThe root cause: rdma_put_gid_attr is not called when sgid_attr is set\nto ERR_PTR(-ENODEV)."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: RDMA/cma: corrija kmemleak en rdma_core observado durante el uso de blktests nvme/rdma siw Al ejecutar blktests nvme/rdma, aparecer\u00e1 el siguiente problema de kmemleak. kmemleak: detector de p\u00e9rdida de memoria del kernel inicializado (mempool disponible: 36041) kmemleak: hilo de escaneo autom\u00e1tico de memoria iniciado kmemleak: 2 nuevas p\u00e9rdidas de memoria sospechosas (ver /sys/kernel/debug/kmemleak) kmemleak: 8 nuevas p\u00e9rdidas de memoria sospechosas (ver /sys/ kernel/debug/kmemleak) kmemleak: 17 nuevas p\u00e9rdidas de memoria sospechosas (ver /sys/kernel/debug/kmemleak) kmemleak: 4 nuevas p\u00e9rdidas de memoria sospechosas (ver /sys/kernel/debug/kmemleak) objeto sin referencia 0xffff88855da53400 (tama\u00f1o 192): comm \"rdma\", pid 10630, sjiffies 4296575922 volcado hexadecimal (primeros 32 bytes): 37 00 00 00 00 00 00 00 c0 ff ff ff 1f 00 00 00 7................. 10 34 a5 5d 85 88 ff ff 10 34 a5 5d 85 88 ff ff .4.].....4.].... backtrace (crc 47f66721): [] kmalloc_trace+0x30d/0x3b0 [&lt; ffffffffc2640ff7&gt;] alloc_gid_entry+0x47/0x380 [ib_core] [] add_modify_gid+0x166/0x930 [ib_core] [] ib_cache_update.part.0+0x6d8/0x910 [ib_core] [] ib_cache_setup_one+0x24a/ 0x350 [ib_core] [] ib_register_device+0x9e/0x3a0 [ib_core] [] 0xffffffffc2a3d389 [] nldev_newlink+0x2b8/0x520 [ib_core] ffffffffc2645fe3&gt;] rdma_nl_rcv_msg+0x2c3/0x520 [ib_core] [ ] rdma_nl_rcv_skb.constprop.0.isra.0+0x23c/0x3a0 [ib_core] [] netlink_unicast+0x445/0x710 [] 0 [] __sys_sendto+0x3a9/0x420 [] __x64_sys_sendto+0xdc/0x1b0 [] do_syscall_64+0x93/0x180 [] Entry_SYSCALL_64_after_hwframe+0x71/0x79 La causa ra\u00edz: _gid_attr no se llama cuando sgid_attr est\u00e1 configurado en ERR_PTR(-ENODEV)."}], "id": "CVE-2024-38539", "lastModified": "2026-08-04T11:18:41.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-38539", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:15:13.442238Z", "version": "2.0.3"}}]}, "published": "2024-06-19T14:15:14.193", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3eb127dc408bf7959a4920d04d16ce10e863686a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6564fc1818404254d1c9f7d75b403b4941516d26"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9c0731832d3b7420cbadba6a7f334363bc8dfb15"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b3a7fb93afd888793ef226e9665fbda98a95c48e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3eb127dc408bf7959a4920d04d16ce10e863686a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6564fc1818404254d1c9f7d75b403b4941516d26"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9c0731832d3b7420cbadba6a7f334363bc8dfb15"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b3a7fb93afd888793ef226e9665fbda98a95c48e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw", "id": "2293460", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2293460"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L", "status": "draft"}, "cwe": "CWE-402", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw\nWhen running blktests nvme/rdma, the following kmemleak issue will appear.\nkmemleak: Kernel memory leak detector initialized (mempool available:36041)\nkmemleak: Automatic memory scanning thread started\nkmemleak: 2 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nkmemleak: 8 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nkmemleak: 17 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nkmemleak: 4 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nunreferenced object 0xffff88855da53400 (size 192):\ncomm \"rdma\", pid 10630, jiffies 4296575922\nhex dump (first 32 bytes):\n37 00 00 00 00 00 00 00 c0 ff ff ff 1f 00 00 00 7...............\n10 34 a5 5d 85 88 ff ff 10 34 a5 5d 85 88 ff ff .4.].....4.]....\nbacktrace (crc 47f66721):\n[<ffffffff911251bd>] kmalloc_trace+0x30d/0x3b0\n[<ffffffffc2640ff7>] alloc_gid_entry+0x47/0x380 [ib_core]\n[<ffffffffc2642206>] add_modify_gid+0x166/0x930 [ib_core]\n[<ffffffffc2643468>] ib_cache_update.part.0+0x6d8/0x910 [ib_core]\n[<ffffffffc2644e1a>] ib_cache_setup_one+0x24a/0x350 [ib_core]\n[<ffffffffc263949e>] ib_register_device+0x9e/0x3a0 [ib_core]\n[<ffffffffc2a3d389>] 0xffffffffc2a3d389\n[<ffffffffc2688cd8>] nldev_newlink+0x2b8/0x520 [ib_core]\n[<ffffffffc2645fe3>] rdma_nl_rcv_msg+0x2c3/0x520 [ib_core]\n[<ffffffffc264648c>]\nrdma_nl_rcv_skb.constprop.0.isra.0+0x23c/0x3a0 [ib_core]\n[<ffffffff9270e7b5>] netlink_unicast+0x445/0x710\n[<ffffffff9270f1f1>] netlink_sendmsg+0x761/0xc40\n[<ffffffff9249db29>] __sys_sendto+0x3a9/0x420\n[<ffffffff9249dc8c>] __x64_sys_sendto+0xdc/0x1b0\n[<ffffffff92db0ad3>] do_syscall_64+0x93/0x180\n[<ffffffff92e00126>] entry_SYSCALL_64_after_hwframe+0x71/0x79\nThe root cause: rdma_put_gid_attr is not called when sgid_attr is set\nto ERR_PTR(-ENODEV)."], "name": "CVE-2024-38539", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-38539\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-38539\nhttps://lore.kernel.org/linux-cve-announce/2024061947-CVE-2024-38539-5ae1@gregkh/T"], "threat_severity": "Low"}

{}