SB2025011752 - Use-after-free in Linux kernel sw siw driver

Description

This security bulletin contains information about 1 security vulnerability.

1) Use-after-free (CVE-ID: CVE-2024-57857)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the siw_query_device(), siw_query_port() and siw_query_qp() functions in drivers/infiniband/sw/siw/siw_verbs.c, within the siw_device_create(), siw_netdev_event() and siw_newlink() functions in drivers/infiniband/sw/siw/siw_main.c, within the siw_create_listen() and siw_cep_set_free_and_put() functions in drivers/infiniband/sw/siw/siw_cm.c. A local user can escalate privileges on the system.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/16b87037b48889d21854c8e97aec8a1baf2642b3
• https://git.kernel.org/stable/c/4eafeb4f021c50d13f199239d913b37de3c83135
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.9