CVE-2021-46983

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-rdma: Fix NULL deref when SEND is completed with error

When running some traffic and taking down the link on peer, a

retry counter exceeded error is received. This leads to

nvmet_rdma_error_comp which tried accessing the cq_context to

obtain the queue. The cq_context is no longer valid after the

fix to use shared CQ mechanism and should be obtained similar

to how it is obtained in other functions from the wc->qp.

[ 905.786331] nvmet_rdma: SEND for CQE 0x00000000e3337f90 failed with status transport retry counter exceeded (12).

[ 905.832048] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048

[ 905.839919] PGD 0 P4D 0

[ 905.842464] Oops: 0000 1 SMP NOPTI

[ 905.846144] CPU: 13 PID: 1557 Comm: kworker/13:1H Kdump: loaded Tainted: G OE --------- - - 4.18.0-304.el8.x86_64 #1

[ 905.872135] RIP: 0010:nvmet_rdma_error_comp+0x5/0x1b [nvmet_rdma]

[ 905.878259] Code: 19 4f c0 e8 89 b3 a5 f6 e9 5b e0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References