CVE-2021-47001 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix cwnd update ordering After a reconnect, the reply handler is opening the cwnd (and thus enabling more RPC Calls to be sent) /before/ rpcrdma_post_recvs() can post enough Receive WRs to receive their replies. This causes an RNR and the new connection is lost immediately. The race is most clearly exposed when KASAN and disconnect injection are enabled. This slows down rpcrdma_rep_create() enough to allow the send side to post a bunch of RPC Calls before the Receive completion handler can invoke ib_post_recv().

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/19b5fa9489b5706bc878c3a522a7f771079e2fa0
https://git.kernel.org/stable/c/35d8b10a25884050bb3b0149b62c3818ec59f77c
https://git.kernel.org/stable/c/8834ecb5df22b7ff3c9b0deba7726579bb613f95
https://git.kernel.org/stable/c/eddae8be7944096419c2ae29477a45f767d0fcd4
https://lore.kernel.org/linux-cve-announce/2024022828-CVE-2021-47001-0e51@gregkh/T/#u
https://nvd.nist.gov/vuln/detail/CVE-2021-47001
https://www.cve.org/CVERecord?id=CVE-2021-47001

History

Mon, 04 Nov 2024 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-02-28T08:13:23.482Z

Updated: 2024-11-04T11:57:28.821Z

Reserved: 2024-02-27T18:42:55.950Z

Link: CVE-2021-47001

Vulnrichment

Updated: 2024-08-04T05:24:38.448Z

NVD

Status : Awaiting Analysis

Published: 2024-02-28T09:15:38.213

Modified: 2024-02-28T14:06:45.783

Link: CVE-2021-47001

Redhat

Severity : Low

Publid Date: 2024-02-28T00:00:00Z

Links: CVE-2021-47001 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47001", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-27T18:42:55.950Z", "datePublished": "2024-02-28T08:13:23.482Z", "dateUpdated": "2024-11-04T11:57:28.821Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:57:28.821Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Fix cwnd update ordering\n\nAfter a reconnect, the reply handler is opening the cwnd (and thus\nenabling more RPC Calls to be sent) /before/ rpcrdma_post_recvs()\ncan post enough Receive WRs to receive their replies. This causes an\nRNR and the new connection is lost immediately.\n\nThe race is most clearly exposed when KASAN and disconnect injection\nare enabled. This slows down rpcrdma_rep_create() enough to allow\nthe send side to post a bunch of RPC Calls before the Receive\ncompletion handler can invoke ib_post_recv()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/xprtrdma/rpc_rdma.c", "net/sunrpc/xprtrdma/verbs.c", "net/sunrpc/xprtrdma/xprt_rdma.h"], "versions": [{"version": "2ae50ad68cd7", "lessThan": "eddae8be7944", "status": "affected", "versionType": "git"}, {"version": "2ae50ad68cd7", "lessThan": "8834ecb5df22", "status": "affected", "versionType": "git"}, {"version": "2ae50ad68cd7", "lessThan": "19b5fa9489b5", "status": "affected", "versionType": "git"}, {"version": "2ae50ad68cd7", "lessThan": "35d8b10a2588", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/xprtrdma/rpc_rdma.c", "net/sunrpc/xprtrdma/verbs.c", "net/sunrpc/xprtrdma/xprt_rdma.h"], "versions": [{"version": "5.5", "status": "affected"}, {"version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.38", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.11.22", "lessThanOrEqual": "5.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.5", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/eddae8be7944096419c2ae29477a45f767d0fcd4"}, {"url": "https://git.kernel.org/stable/c/8834ecb5df22b7ff3c9b0deba7726579bb613f95"}, {"url": "https://git.kernel.org/stable/c/19b5fa9489b5706bc878c3a522a7f771079e2fa0"}, {"url": "https://git.kernel.org/stable/c/35d8b10a25884050bb3b0149b62c3818ec59f77c"}], "title": "xprtrdma: Fix cwnd update ordering", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47001", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-05T16:58:29.225383Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:14:54.379Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:38.448Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/eddae8be7944096419c2ae29477a45f767d0fcd4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8834ecb5df22b7ff3c9b0deba7726579bb613f95", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/19b5fa9489b5706bc878c3a522a7f771079e2fa0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/35d8b10a25884050bb3b0149b62c3818ec59f77c", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/eddae8be7944096419c2ae29477a45f767d0fcd4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8834ecb5df22b7ff3c9b0deba7726579bb613f95", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/19b5fa9489b5706bc878c3a522a7f771079e2fa0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/35d8b10a25884050bb3b0149b62c3818ec59f77c", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:38.448Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47001", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-05T16:58:29.225383Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:15.443Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "xprtrdma: Fix cwnd update ordering", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2ae50ad68cd7", "lessThan": "eddae8be7944", "versionType": "git"}, {"status": "affected", "version": "2ae50ad68cd7", "lessThan": "8834ecb5df22", "versionType": "git"}, {"status": "affected", "version": "2ae50ad68cd7", "lessThan": "19b5fa9489b5", "versionType": "git"}, {"status": "affected", "version": "2ae50ad68cd7", "lessThan": "35d8b10a2588", "versionType": "git"}], "programFiles": ["net/sunrpc/xprtrdma/rpc_rdma.c", "net/sunrpc/xprtrdma/verbs.c", "net/sunrpc/xprtrdma/xprt_rdma.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"status": "unaffected", "version": "0", "lessThan": "5.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.38", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.11.22", "versionType": "semver", "lessThanOrEqual": "5.11.*"}, {"status": "unaffected", "version": "5.12.5", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sunrpc/xprtrdma/rpc_rdma.c", "net/sunrpc/xprtrdma/verbs.c", "net/sunrpc/xprtrdma/xprt_rdma.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/eddae8be7944096419c2ae29477a45f767d0fcd4"}, {"url": "https://git.kernel.org/stable/c/8834ecb5df22b7ff3c9b0deba7726579bb613f95"}, {"url": "https://git.kernel.org/stable/c/19b5fa9489b5706bc878c3a522a7f771079e2fa0"}, {"url": "https://git.kernel.org/stable/c/35d8b10a25884050bb3b0149b62c3818ec59f77c"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Fix cwnd update ordering\n\nAfter a reconnect, the reply handler is opening the cwnd (and thus\nenabling more RPC Calls to be sent) /before/ rpcrdma_post_recvs()\ncan post enough Receive WRs to receive their replies. This causes an\nRNR and the new connection is lost immediately.\n\nThe race is most clearly exposed when KASAN and disconnect injection\nare enabled. This slows down rpcrdma_rep_create() enough to allow\nthe send side to post a bunch of RPC Calls before the Receive\ncompletion handler can invoke ib_post_recv()."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:57:28.821Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47001", "state": "PUBLISHED", "dateUpdated": "2024-11-04T11:57:28.821Z", "dateReserved": "2024-02-27T18:42:55.950Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-02-28T08:13:23.482Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: xprtrdma: Fix cwnd update ordering", "id": "2266869", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2266869"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxprtrdma: Fix cwnd update ordering\nAfter a reconnect, the reply handler is opening the cwnd (and thus\nenabling more RPC Calls to be sent) /before/ rpcrdma_post_recvs()\ncan post enough Receive WRs to receive their replies. This causes an\nRNR and the new connection is lost immediately.\nThe race is most clearly exposed when KASAN and disconnect injection\nare enabled. This slows down rpcrdma_rep_create() enough to allow\nthe send side to post a bunch of RPC Calls before the Receive\ncompletion handler can invoke ib_post_recv()."], "name": "CVE-2021-47001", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-02-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47001\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47001\nhttps://lore.kernel.org/linux-cve-announce/2024022828-CVE-2021-47001-0e51@gregkh/T/#u"], "threat_severity": "Low", "upstream_fix": "kernel 5.10.38, kernel 5.11.22, kernel 5.12.5, kernel 5.13"}