{"id":13000,"date":"2018-08-02T14:19:07","date_gmt":"2018-08-02T22:19:07","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2018\/08\/02\/news-6767\/"},"modified":"2018-08-02T14:19:07","modified_gmt":"2018-08-02T22:19:07","slug":"news-6767","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/08\/02\/news-6767\/","title":{"rendered":"SSD Advisory \u2013 Infiniband Linux Driver UAF"},"content":{"rendered":"

Credit to Author: SSD \/ Ori Nimron| Date: Thu, 02 Aug 2018 12:10:25 +0000<\/strong><\/p>\n

\n
\n

Vulnerability Summary<\/strong>
A bug in the threads synchronization of Infiniband Driver can cause an Use After Free. A struct that is allocated and free’d by a thread, is accessible through a second thread. If the second thread is calling the function “idr_find” before the struct was free’d by the first thread, then he can still use the struct after it was free’d.<\/p>\n

Vendor Response<\/strong>
“Infiniband: fix a possible use-after-free bug has been added to the 4.17-stable tree. Patches currently in stable-queue\u00a0are queue-4.17\/infiniband-fix-a-possible-use-after-free-bug.patch”<\/p>\n

CVE<\/strong>
CVE-2018-14737<\/p>\n

Credit<\/strong>
An independent security researcher has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.
<\/span>
Affected systems<\/strong>
Linux systems that contains the Infiniband Driver running Kernel version older than 4.17 (The version that the patch was issued into).<\/p>\n

Vulnerability Details<\/strong>
The function ucma_process_join() free’s the new allocated “mc” struct, if there is any error after that.<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n

C<\/span><\/div>\n<\/div>\n

<\/div>\n