{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-47749", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-30T16:00:12.961Z", "datePublished": "2024-10-21T12:14:15.126Z", "dateUpdated": "2026-08-05T11:39:57.111Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:57.111Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cxgb4: Added NULL check for lookup_atid\n\nThe lookup_atid() function can return NULL if the ATID is\ninvalid or does not exist in the identifier table, which\ncould lead to dereferencing a null pointer without a\ncheck in the `act_establish()` and `act_open_rpl()` functions.\nAdd a NULL check to prevent null pointer dereferencing.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable handlers process `CPL_ACT_ESTABLISH`/`CPL_ACT_OPEN_RPL` that the Chelsio TOE emits in direct response to a remote peer's TCP handshake behavior (SYN-ACK, RST, timeout, 4-tuple collision), so a remote iWARP peer or off-path RST injector controls which CPL arrives and when it races the driver's atid teardown. iWARP clients (NVMe-oF/RDMA, NFS/RDMA, iSER, SMB Direct) connect out across routed networks, making this remotely reachable.\nAC:L - The remote peer controls the timing of its handshake response and can stall until the ep timer fires (`process_timeout()` → `c4iw_ep_disconnect()` in the `CONNECTING` state) before completing or resetting, so it controls both sides of the race and can retry indefinitely at no cost. Atid-table exhaustion, which makes the freed slot read back as NULL, is likewise inducible by flooding concurrent connects.\nPR:N - `act_establish()` and `act_open_rpl()` run at TCP handshake completion/failure, long before MPA negotiation or any credential exchange, so the peer driving the condition is entirely unauthenticated. No privileges on the target are needed for the remote side of the attack.\nUI:N - No victim action is required — the connection attempts are made by already-running RDMA ULPs or reconnect loops, and the CPL processing happens asynchronously in the `iw_cxgb4` workqueue.\nS:U - The NULL dereference crashes the kernel that contains the flaw; no security authority boundary such as a VM or IOMMU domain is crossed.\nC:N - The dereference is of a NULL `struct c4iw_ep *` at small member offsets (`com.mutex`, `dst`, `com.local_addr`), all below `mmap_min_addr`, so it faults immediately with no attacker-mapped page and yields no read primitive or information disclosure.\nI:N - No memory is written through the NULL pointer before the fault, and the bug provides no write primitive or control-flow hijack — it is a pure crash.\nA:H - The dereference produces a kernel oops in workqueue context, which is a full panic on `panic_on_oops` systems; even absent that, the ordered `iw_cxgb4` workqueue is wedged, stalling all RDMA connection management for the adapter." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/hw/cxgb4/cm.c" ], "versions": [ { "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "b12e25d91c7f97958341538c7dc63ee49d01548f", "status": "affected", "versionType": "git" }, { "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "4e1fe68d695af367506ea3c794c5969630f21697", "status": "affected", "versionType": "git" }, { "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "dd598ac57dcae796cb58551074660c39b43fb155", "status": "affected", "versionType": "git" }, { "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "b11318dc8a1ec565300bb1a9073095af817cc508", "status": "affected", "versionType": "git" }, { "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "39cb9f39913566ec5865581135f3e8123ad1aee1", "status": "affected", "versionType": "git" }, { "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "0d50ae281a1712b9b2ca72830a96b8f11882358d", "status": "affected", "versionType": "git" }, { "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "54aaa3ed40972511e423b604324b881425b9ff1e", "status": "affected", "versionType": "git" }, { "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "b9c94c8ba5a713817cffd74c4bacc05187469624", "status": "affected", "versionType": "git" }, { "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "e766e6a92410ca269161de059fff0843b8ddd65f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/hw/cxgb4/cm.c" ], "versions": [ { "version": "2.6.35", "status": "affected" }, { "version": "0", "lessThan": "2.6.35", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.323", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.285", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.227", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.54", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.13", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.2", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "4.19.323" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.4.285" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.10.227" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.1.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.6.54" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.10.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.11.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b12e25d91c7f97958341538c7dc63ee49d01548f" }, { "url": "https://git.kernel.org/stable/c/4e1fe68d695af367506ea3c794c5969630f21697" }, { "url": "https://git.kernel.org/stable/c/dd598ac57dcae796cb58551074660c39b43fb155" }, { "url": "https://git.kernel.org/stable/c/b11318dc8a1ec565300bb1a9073095af817cc508" }, { "url": "https://git.kernel.org/stable/c/39cb9f39913566ec5865581135f3e8123ad1aee1" }, { "url": "https://git.kernel.org/stable/c/0d50ae281a1712b9b2ca72830a96b8f11882358d" }, { "url": "https://git.kernel.org/stable/c/54aaa3ed40972511e423b604324b881425b9ff1e" }, { "url": "https://git.kernel.org/stable/c/b9c94c8ba5a713817cffd74c4bacc05187469624" }, { "url": "https://git.kernel.org/stable/c/e766e6a92410ca269161de059fff0843b8ddd65f" } ], "title": "RDMA/cxgb4: Added NULL check for lookup_atid", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-47749", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-21T12:58:09.975914Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T13:04:13.297Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:21:44.230Z" } } ] } }