{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47378","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-21T14:58:30.811Z","datePublished":"2024-05-21T15:03:41.038Z","dateUpdated":"2026-08-05T08:47:31.303Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:47:31.303Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: destroy cm id before destroy qp to avoid use after free\n\nWe should always destroy cm_id before destroy qp to avoid to get cma\nevent after qp was destroyed, which may lead to use after free.\nIn RDMA connection establishment error flow, don't destroy qp in cm\nevent handler.Just report cm_error to upper level, qp will be destroy\nin nvme_rdma_alloc_queue() after destroy cm id."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The nvme-rdma initiator processes RDMA CM events (REJECTED/CONNECT_ERROR/UNREACHABLE/DISCONNECTED) from a remote NVMe-oF peer over InfiniBand/RoCE/iWARP; a malicious or compromised target drives the buggy destroy-QP-before-cm_id paths via fabric protocol messages on connect/reconnect/teardown.\nAC:L - The remote peer fully controls CM handshake failures and disconnects that enter nvme_rdma_cm_handler and later free_queue, so it can reliably cause QP destruction while cm_id remains live and deliver further CMA events into the UAF window.\nPR:N - Once an NVMe-RDMA controller session exists (typical datacenter autoconnect), the attacker needs no account or capabilities on the victim host and triggers the bug solely as the unauthenticated fabric peer.\nUI:N - No extra victim action is required at exploit time beyond a pre-existing or auto-reconnecting NVMe-RDMA attachment; CM error and disconnect handling runs in kernel context from peer events.\nS:U - The use-after-free corrupts host-kernel RDMA/NVMe structures under the same OS security authority and does not cross a VM, IOMMU, or other distinct boundary.\nC:H - Destroying the QP/ring while cm_id can still deliver CMA callbacks is a kernel heap use-after-free; per UAF guidance this enables heap reuse and arbitrary kernel read primitives.\nI:H - The same freed QP-related objects are sprayable for arbitrary write and control-flow hijacking in kernel context once reclaimed.\nA:H - Use-after-free of the queue IB resources can oops/panic the kernel during CM handling or teardown even without a full exploit, fully denying availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/host/rdma.c"],"versions":[{"version":"7110230719602852481c2793d054f866b2bf4a2b","lessThan":"ecf0dc5a904830c926a64feffd8e01141f89822f","status":"affected","versionType":"git"},{"version":"7110230719602852481c2793d054f866b2bf4a2b","lessThan":"d268a182c56e8361e19fb781137411643312b994","status":"affected","versionType":"git"},{"version":"7110230719602852481c2793d054f866b2bf4a2b","lessThan":"9817d763dbe15327b9b3ff4404fa6f27f927e744","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/host/rdma.c"],"versions":[{"version":"4.8","status":"affected"},{"version":"0","lessThan":"4.8","status":"unaffected","versionType":"semver"},{"version":"5.10.70","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.14.9","lessThanOrEqual":"5.14.*","status":"unaffected","versionType":"semver"},{"version":"5.15","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"5.10.70"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"5.14.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"5.15"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/ecf0dc5a904830c926a64feffd8e01141f89822f"},{"url":"https://git.kernel.org/stable/c/d268a182c56e8361e19fb781137411643312b994"},{"url":"https://git.kernel.org/stable/c/9817d763dbe15327b9b3ff4404fa6f27f927e744"}],"title":"nvme-rdma: destroy cm id before destroy qp to avoid use after free","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-416","lang":"en","description":"CWE-416 Use After Free"}]}],"affected":[{"vendor":"linux","product":"linux_kernel","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","versions":[{"version":"1da177e4c3f4","status":"affected"}]},{"vendor":"linux","product":"linux_kernel","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","versions":[{"version":"5.10.70","status":"unaffected"}]},{"vendor":"linux","product":"linux_kernel","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","versions":[{"version":"5.14.9","status":"unaffected"}]},{"vendor":"linux","product":"linux_kernel","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","versions":[{"version":"5.15","status":"unaffected"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-01-16T21:04:16.754681Z","id":"CVE-2021-47378","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-01-16T21:04:30.711Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T05:32:08.590Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/ecf0dc5a904830c926a64feffd8e01141f89822f","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/d268a182c56e8361e19fb781137411643312b994","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/9817d763dbe15327b9b3ff4404fa6f27f927e744","tags":["x_transferred"]}]}]}}