CVE-2021-47196
📋 TL;DR
This is a use-after-free vulnerability in the Linux kernel's RDMA subsystem that occurs during QP (Queue Pair) creation failure. It allows attackers with local access to potentially crash the system or execute arbitrary code. Affects systems using RDMA with mlx5 drivers in vulnerable kernel versions.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level code execution, potentially leading to full system compromise.
Likely Case
Kernel panic or system crash causing denial of service.
If Mitigated
No impact if patched or RDMA not in use.
🎯 Exploit Status
Requires local access and ability to create RDMA QPs. The vulnerability is triggered during QP creation failure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions with commits 6cd7397d01c4a3e09757840299e4f114f0aa5fa0 or b70e072feffa0ba5c41a99b9524b9878dee7748e
Vendor Advisory: https://git.kernel.org/stable/c/6cd7397d01c4a3e09757840299e4f114f0aa5fa0
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable RDMA
linuxDisable RDMA functionality if not required
modprobe -r mlx5_ib
modprobe -r ib_core
Restrict RDMA access
linuxUse kernel module blacklisting to prevent RDMA module loading
echo 'blacklist mlx5_ib' >> /etc/modprobe.d/blacklist.conf
echo 'blacklist ib_core' >> /etc/modprobe.d/blacklist.conf
🧯 If You Can't Patch
- Disable RDMA functionality completely if not required
- Restrict local user access to systems with RDMA enabled
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if RDMA modules are loaded: 'uname -r' and 'lsmod | grep -E "mlx5_ib|ib_core"'Check Version:
uname -rVerify Fix Applied:
Verify kernel version is patched and test RDMA functionality if required📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- KASAN reports for use-after-free in create_qp
- System crashes during RDMA operations
Network Indicators:
- None - local vulnerability
SIEM Query:
source="kernel" AND ("KASAN" OR "use-after-free" OR "create_qp")