CVE-2024-43872

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-43872", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-17T09:11:59.281Z", "datePublished": "2024-08-21T00:06:24.041Z", "dateUpdated": "2026-10-30T12:19:05.518Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:19:05.518Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix soft lockup under heavy CEQE load\n\nCEQEs are handled in interrupt handler currently. This may cause the\nCPU core staying in interrupt context too long and lead to soft lockup\nunder heavy load.\n\nHandle CEQEs in BH workqueue and set an upper limit for the number of\nCEQE handled by a single call of work handler."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - CEQE production is driven by completions on armed CQs, which a remote RoCE peer generates directly via incoming SEND/RDMA-write-with-immediate, CM/MAD and RDMA-CM connection traffic to an RDMA-listening host (nvmet-rdma, NFS/RDMA, SMB Direct); RoCEv2 rides routable UDP/4791, so the completion flood that pins the CPU can be driven from off-segment.\nAC:L - No race, no memory-layout dependency, no timing window \u2014 the attacker simply sustains a high completion rate, and the unbounded hardirq drain loop cannot exit while the hardware keeps posting entries. This was hit by ordinary heavy load in production, so deliberate flooding is entirely reliable.\nPR:N - Receive completions are generated by the HCA at the queue level, before any ULP-level authentication \u2014 nvmet-rdma and NFS/RDMA post and complete receive buffers pre-auth, and RDMA-CM connection-establishment packets complete on armed CQs with no credentials at all. The alternative local path (unprivileged verbs access via world-readable /dev/infiniband/uverbs*) is only PR:L, so the unauthenticated remote path governs.\nUI:N - The attack is purely traffic-driven against a listening RDMA endpoint or an unprivileged local WR flood; no action by any user or administrator on the victim system is required.\nS:U - The CPU stall and watchdog lockup occur inside the kernel of the affected host, within the same security authority as the vulnerable driver; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The CQN read from the CEQE is masked with num_cqs-1 before the xa_load(), so there is no out-of-bounds read and no attacker-observable data is exposed \u2014 the defect is a failure to bound loop iterations, not a memory-safety error.\nI:N - No memory is corrupted and no data is modified; the loop only consumes valid, hardware-owned queue entries and dispatches legitimate completion callbacks.\nA:H - The CPU core is pinned indefinitely in hard interrupt context, producing a soft lockup with cascading RCU stalls and scheduler starvation, and the missed update_eq_db() lets the CEQ overflow into device reset; on hosts with kernel.softlockup_panic=1 (common in kdump/HA configurations) this is an outright kernel panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/hns/hns_roce_device.h", "drivers/infiniband/hw/hns/hns_roce_hw_v2.c"], "versions": [{"version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4", "lessThan": "97740304c953ac43aebd24678ae999fe0bc9decf", "status": "affected", "versionType": "git"}, {"version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4", "lessThan": "06580b33c183c9f98e2a2ca96a86137179032c08", "status": "affected", "versionType": "git"}, {"version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4", "lessThan": "2fdf34038369c0a27811e7b4680662a14ada1d6b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/hns/hns_roce_device.h", "drivers/infiniband/hw/hns/hns_roce_hw_v2.c"], "versions": [{"version": "4.16", "status": "affected"}, {"version": "0", "lessThan": "4.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.3", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.10.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/97740304c953ac43aebd24678ae999fe0bc9decf"}, {"url": "https://git.kernel.org/stable/c/06580b33c183c9f98e2a2ca96a86137179032c08"}, {"url": "https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b"}], "title": "RDMA/hns: Fix soft lockup under heavy CEQE load", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43872", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:06:16.645858Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:18.467Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43872", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:06:16.645858Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:22.673Z"}}], "cna": {"title": "RDMA/hns: Fix soft lockup under heavy CEQE load", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - CEQE production is driven by completions on armed CQs, which a remote RoCE peer generates directly via incoming SEND/RDMA-write-with-immediate, CM/MAD and RDMA-CM connection traffic to an RDMA-listening host (nvmet-rdma, NFS/RDMA, SMB Direct); RoCEv2 rides routable UDP/4791, so the completion flood that pins the CPU can be driven from off-segment.\nAC:L - No race, no memory-layout dependency, no timing window \u2014 the attacker simply sustains a high completion rate, and the unbounded hardirq drain loop cannot exit while the hardware keeps posting entries. This was hit by ordinary heavy load in production, so deliberate flooding is entirely reliable.\nPR:N - Receive completions are generated by the HCA at the queue level, before any ULP-level authentication \u2014 nvmet-rdma and NFS/RDMA post and complete receive buffers pre-auth, and RDMA-CM connection-establishment packets complete on armed CQs with no credentials at all. The alternative local path (unprivileged verbs access via world-readable /dev/infiniband/uverbs*) is only PR:L, so the unauthenticated remote path governs.\nUI:N - The attack is purely traffic-driven against a listening RDMA endpoint or an unprivileged local WR flood; no action by any user or administrator on the victim system is required.\nS:U - The CPU stall and watchdog lockup occur inside the kernel of the affected host, within the same security authority as the vulnerable driver; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The CQN read from the CEQE is masked with num_cqs-1 before the xa_load(), so there is no out-of-bounds read and no attacker-observable data is exposed \u2014 the defect is a failure to bound loop iterations, not a memory-safety error.\nI:N - No memory is corrupted and no data is modified; the loop only consumes valid, hardware-owned queue entries and dispatches legitimate completion callbacks.\nA:H - The CPU core is pinned indefinitely in hard interrupt context, producing a soft lockup with cascading RCU stalls and scheduler starvation, and the missed update_eq_db() lets the CEQ overflow into device reset; on hosts with kernel.softlockup_panic=1 (common in kdump/HA configurations) this is an outright kernel panic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4", "lessThan": "97740304c953ac43aebd24678ae999fe0bc9decf", "versionType": "git"}, {"status": "affected", "version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4", "lessThan": "06580b33c183c9f98e2a2ca96a86137179032c08", "versionType": "git"}, {"status": "affected", "version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4", "lessThan": "2fdf34038369c0a27811e7b4680662a14ada1d6b", "versionType": "git"}], "programFiles": ["drivers/infiniband/hw/hns/hns_roce_device.h", "drivers/infiniband/hw/hns/hns_roce_hw_v2.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"status": "unaffected", "version": "0", "lessThan": "4.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.10.3", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/hw/hns/hns_roce_device.h", "drivers/infiniband/hw/hns/hns_roce_hw_v2.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/97740304c953ac43aebd24678ae999fe0bc9decf"}, {"url": "https://git.kernel.org/stable/c/06580b33c183c9f98e2a2ca96a86137179032c08"}, {"url": "https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix soft lockup under heavy CEQE load\n\nCEQEs are handled in interrupt handler currently. This may cause the\nCPU core staying in interrupt context too long and lead to soft lockup\nunder heavy load.\n\nHandle CEQEs in BH workqueue and set an upper limit for the number of\nCEQE handled by a single call of work handler."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.3", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "4.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:19:05.518Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43872", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:19:05.518Z", "dateReserved": "2024-08-17T09:11:59.281Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-08-21T00:06:24.041Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/hns/hns_roce_device.h", "drivers/infiniband/hw/hns/hns_roce_hw_v2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "97740304c953ac43aebd24678ae999fe0bc9decf", "status": "affected", "version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4", "versionType": "git"}, {"lessThan": "06580b33c183c9f98e2a2ca96a86137179032c08", "status": "affected", "version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4", "versionType": "git"}, {"lessThan": "2fdf34038369c0a27811e7b4680662a14ada1d6b", "status": "affected", "version": "a5073d6054f75d7c94b3354206eec4b804d2fbd4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/hns/hns_roce_device.h", "drivers/infiniband/hw/hns/hns_roce_hw_v2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"lessThan": "4.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B2194910-A867-4355-9344-95E7D3E499E3", "versionEndExcluding": "6.10.3", "versionStartIncluding": "4.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix soft lockup under heavy CEQE load\n\nCEQEs are handled in interrupt handler currently. This may cause the\nCPU core staying in interrupt context too long and lead to soft lockup\nunder heavy load.\n\nHandle CEQEs in BH workqueue and set an upper limit for the number of\nCEQE handled by a single call of work handler."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: RDMA/hns: corrige el bloqueo suave bajo carga pesada de CEQE. Actualmente, los CEQE se manejan en el controlador de interrupciones. Esto puede hacer que el n\u00facleo de la CPU permanezca en el contexto de interrupci\u00f3n durante demasiado tiempo y provocar un bloqueo suave bajo una carga pesada. Maneje CEQE en la cola de trabajo de BH y establezca un l\u00edmite superior para la cantidad de CEQE manejados por una sola llamada de controlador de trabajo."}], "id": "CVE-2024-43872", "lastModified": "2026-10-30T13:17:33.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-43872", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:06:16.645858Z", "version": "2.0.3"}}]}, "published": "2024-08-21T01:15:11.740", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/06580b33c183c9f98e2a2ca96a86137179032c08"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/97740304c953ac43aebd24678ae999fe0bc9decf"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: RDMA/hns: Fix soft lockup under heavy CEQE load", "id": "2306366", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2306366"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/hns: Fix soft lockup under heavy CEQE load\nCEQEs are handled in interrupt handler currently. This may cause the\nCPU core staying in interrupt context too long and lead to soft lockup\nunder heavy load.\nHandle CEQEs in BH workqueue and set an upper limit for the number of\nCEQE handled by a single call of work handler."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-43872", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-08-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-43872\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-43872\nhttps://lore.kernel.org/linux-cve-announce/2024082136-CVE-2024-43872-c87e@gregkh/T"], "statement": "Following issue marked as moderate with \"not affected or will not fix\" for Red Hat Enterprise Linux, as it is not vulnerable to this CVE. This is because the CVE does not impact the versions or configurations of the Linux kernel used in Red Hat's distributions.", "threat_severity": "Moderate"}

{}