{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-47197","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-03-25T09:12:14.116Z","datePublished":"2024-04-10T18:56:33.260Z","dateUpdated":"2025-05-04T12:41:15.139Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2025-05-04T12:41:15.139Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()\n\nPrior to this patch in case mlx5_core_destroy_cq() failed it proceeds\nto rest of destroy operations. mlx5_core_destroy_cq() could be called again\nby user and cause additional call of mlx5_debug_cq_remove().\ncq->dbg was not nullify in previous call and cause the crash.\n\nFix it by nullify cq->dbg pointer after removal.\n\nAlso proceed to destroy operations only if FW return 0\nfor MLX5_CMD_OP_DESTROY_CQ command.\n\ngeneral protection fault, probably for non-canonical address 0x2000300004058: 0000 [#1] SMP PTI\nCPU: 5 PID: 1228 Comm: python Not tainted 5.15.0-rc5_for_upstream_min_debug_2021_10_14_11_06 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:lockref_get+0x1/0x60\nCode: 5d e9 53 ff ff ff 48 8d 7f 70 e8 0a 2e 48 00 c7 85 d0 00 00 00 02\n00 00 00 c6 45 70 00 fb 5d c3 c3 cc cc cc cc cc cc cc cc 53 <48> 8b 17\n48 89 fb 85 d2 75 3d 48 89 d0 bf 64 00 00 00 48 89 c1 48\nRSP: 0018:ffff888137dd7a38 EFLAGS: 00010206\nRAX: 0000000000000000 RBX: ffff888107d5f458 RCX: 00000000fffffffe\nRDX: 000000000002c2b0 RSI: ffffffff8155e2e0 RDI: 0002000300004058\nRBP: ffff888137dd7a88 R08: 0002000300004058 R09: ffff8881144a9f88\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8881141d4000\nR13: ffff888137dd7c68 R14: ffff888137dd7d58 R15: ffff888137dd7cc0\nFS:  00007f4644f2a4c0(0000) GS:ffff8887a2d40000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055b4500f4380 CR3: 0000000114f7a003 CR4: 0000000000170ea0\nCall Trace:\n  simple_recursive_removal+0x33/0x2e0\n  ? debugfs_remove+0x60/0x60\n  debugfs_remove+0x40/0x60\n  mlx5_debug_cq_remove+0x32/0x70 [mlx5_core]\n  mlx5_core_destroy_cq+0x41/0x1d0 [mlx5_core]\n  devx_obj_cleanup+0x151/0x330 [mlx5_ib]\n  ? __pollwait+0xd0/0xd0\n  ? xas_load+0x5/0x70\n  ? xa_load+0x62/0xa0\n  destroy_hw_idr_uobject+0x20/0x80 [ib_uverbs]\n  uverbs_destroy_uobject+0x3b/0x360 [ib_uverbs]\n  uobj_destroy+0x54/0xa0 [ib_uverbs]\n  ib_uverbs_cmd_verbs+0xaf2/0x1160 [ib_uverbs]\n  ? uverbs_finalize_object+0xd0/0xd0 [ib_uverbs]\n  ib_uverbs_ioctl+0xc4/0x1b0 [ib_uverbs]\n  __x64_sys_ioctl+0x3e4/0x8e0"}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/cq.c","drivers/net/ethernet/mellanox/mlx5/core/debugfs.c"],"versions":[{"version":"4f7bddf8c5c01cac74373443b13a68e1c6723a94","lessThan":"471c492890557bd58f73314bb4ad85d5a8fd5026","status":"affected","versionType":"git"},{"version":"94b960b9deffc02fc0747afc01f72cc62ab099e3","lessThan":"2ae38157080616a13a9fe3f0b4b6ec0070aa408a","status":"affected","versionType":"git"},{"version":"94b960b9deffc02fc0747afc01f72cc62ab099e3","lessThan":"76ded29d3fcda4928da8849ffc446ea46871c1c2","status":"affected","versionType":"git"},{"version":"ed8aafea4fec9c654e63445236e0b505e27ed3a7","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/cq.c","drivers/net/ethernet/mellanox/mlx5/core/debugfs.c"],"versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","status":"unaffected","versionType":"semver"},{"version":"5.10.82","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.5","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"5.16","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.75","versionEndExcluding":"5.10.82"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14.14"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/471c492890557bd58f73314bb4ad85d5a8fd5026"},{"url":"https://git.kernel.org/stable/c/2ae38157080616a13a9fe3f0b4b6ec0070aa408a"},{"url":"https://git.kernel.org/stable/c/76ded29d3fcda4928da8849ffc446ea46871c1c2"}],"title":"net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-21T16:04:48.403112Z","id":"CVE-2021-47197","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-21T16:04:55.421Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T05:32:07.338Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/471c492890557bd58f73314bb4ad85d5a8fd5026","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/2ae38157080616a13a9fe3f0b4b6ec0070aa408a","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/76ded29d3fcda4928da8849ffc446ea46871c1c2","tags":["x_transferred"]}]}]}}