CVE-2024-42285

In the Linux kernel, the following vulnerability has been resolved:

RDMA/iwcm: Fix a use-after-free related to destroying CM IDs

iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with an existing struct iw_cm_id (cm_id) as follows:

    conn_id->cm_id.iw = cm_id;
    cm_id->context = conn_id;
    cm_id->cm_handler = cma_iw_handler;

rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make sure that cm_work_handler() does not trigger a use-after-free by only freeing of the struct rdma_id_private after all pending work has finished.

This vulnerability is rated as having Moderate impact for Red Hat Enterprise Linux because exploitation requires a local user to interact with the RDMA subsystem, and triggering the race condition typically leads to kernel instability or denial of service rather than reliable privilege escalation. Furthermore, iWARP RDMA support is not enabled or utilized in standard default environments, limiting exposure primarily to systems configured for specialized high-performance networking. Successful exploitation requires specific timing during connection destruction while asynchronous worker threads are active.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.