github - ghsa-cww8-qc9w-3hxp

ghsa-cww8-qc9w-3hxp

Vulnerability from github

Published

2024-07-12 15:31

Modified

2024-07-12 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Add check for srq max_sge attribute

max_sge attribute is passed by the user, and is inserted and used unchecked, so verify that the value doesn't exceed maximum allowed value before using it.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-40990"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-12T13:15:20Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Add check for srq max_sge attribute\n\nmax_sge attribute is passed by the user, and is inserted and used\nunchecked, so verify that the value doesn\u0027t exceed maximum allowed value\nbefore using it.",
  "id": "GHSA-cww8-qc9w-3hxp",
  "modified": "2024-07-12T15:31:29Z",
  "published": "2024-07-12T15:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40990"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1e692244bf7dd827dd72edc6c4a3b36ae572f03c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/36ab7ada64caf08f10ee5a114d39964d1f91e81d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4ab99e3613139f026d2d8ba954819e2876120ab3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7186b81c1f15e39069b1af172c6a951728ed3511"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/999586418600b4b3b93c2a0edd3a4ca71ee759bf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e0deb0e9c967b61420235f7f17a4450b4b4d6ce2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

cve-2024-40990

Vulnerability from cvelistv5

Published

2024-07-12 12:37

Modified

2024-11-05 09:34

Severity ?

Summary

RDMA/mlx5: Add check for srq max_sge attribute

References

▼	URL	Tags
	https://git.kernel.org/stable/c/7186b81c1f15e39069b1af172c6a951728ed3511
	https://git.kernel.org/stable/c/1e692244bf7dd827dd72edc6c4a3b36ae572f03c
	https://git.kernel.org/stable/c/999586418600b4b3b93c2a0edd3a4ca71ee759bf
	https://git.kernel.org/stable/c/e0deb0e9c967b61420235f7f17a4450b4b4d6ce2
	https://git.kernel.org/stable/c/4ab99e3613139f026d2d8ba954819e2876120ab3
	https://git.kernel.org/stable/c/36ab7ada64caf08f10ee5a114d39964d1f91e81d

Impacted products

Vendor

Product

Version

▼

Linux

Version: e126ba97dba9
Version: e126ba97dba9
Version: e126ba97dba9
Version: e126ba97dba9
Version: e126ba97dba9
Version: e126ba97dba9

Linux

Version: 3.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:39:56.093Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7186b81c1f15e39069b1af172c6a951728ed3511"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1e692244bf7dd827dd72edc6c4a3b36ae572f03c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/999586418600b4b3b93c2a0edd3a4ca71ee759bf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e0deb0e9c967b61420235f7f17a4450b4b4d6ce2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4ab99e3613139f026d2d8ba954819e2876120ab3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/36ab7ada64caf08f10ee5a114d39964d1f91e81d"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40990",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:01:51.391484Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:20.373Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/srq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7186b81c1f15",
              "status": "affected",
              "version": "e126ba97dba9",
              "versionType": "git"
            },
            {
              "lessThan": "1e692244bf7d",
              "status": "affected",
              "version": "e126ba97dba9",
              "versionType": "git"
            },
            {
              "lessThan": "999586418600",
              "status": "affected",
              "version": "e126ba97dba9",
              "versionType": "git"
            },
            {
              "lessThan": "e0deb0e9c967",
              "status": "affected",
              "version": "e126ba97dba9",
              "versionType": "git"
            },
            {
              "lessThan": "4ab99e361313",
              "status": "affected",
              "version": "e126ba97dba9",
              "versionType": "git"
            },
            {
              "lessThan": "36ab7ada64ca",
              "status": "affected",
              "version": "e126ba97dba9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/srq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Add check for srq max_sge attribute\n\nmax_sge attribute is passed by the user, and is inserted and used\nunchecked, so verify that the value doesn\u0027t exceed maximum allowed value\nbefore using it."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T09:34:36.939Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7186b81c1f15e39069b1af172c6a951728ed3511"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e692244bf7dd827dd72edc6c4a3b36ae572f03c"
        },
        {
          "url": "https://git.kernel.org/stable/c/999586418600b4b3b93c2a0edd3a4ca71ee759bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0deb0e9c967b61420235f7f17a4450b4b4d6ce2"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ab99e3613139f026d2d8ba954819e2876120ab3"
        },
        {
          "url": "https://git.kernel.org/stable/c/36ab7ada64caf08f10ee5a114d39964d1f91e81d"
        }
      ],
      "title": "RDMA/mlx5: Add check for srq max_sge attribute",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40990",
    "datePublished": "2024-07-12T12:37:34.485Z",
    "dateReserved": "2024-07-12T12:17:45.605Z",
    "dateUpdated": "2024-11-05T09:34:36.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted