In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08 Currently rsv_qp is freed before ib_unregister_device() is called on HIP08. During the time interval, users can still dereg MR and rsv_qp will be used in this process, leading to a UAF. Move the release of rsv_qp after calling ib_unregister_device() to fix it.
| Product | Vendor | Version |
|---|---|---|
| Linux | Linux | n/a |
| Linux | Linux | Atlantis Word Processor 3.2.7.1, 3.2.7.2 |
| Linux | Linux | 11.5(1)SU10 |
| Linux | Linux | <= 4.14.* |