CVE-2021-47012

What it actually does

Use-after-free in siw_alloc_mr where mr->mem is assigned before an xa_alloc_cyclic failure frees the object via kfree, leaving a dangling pointer that is later dereferenced in the siw_mr_drop_mem error path.

Why it matters to the business

Kernel instability, crashes, or potential local privilege escalation on systems using the siw RDMA driver; high operational risk for storage and high-performance networking workloads until patched.

How an attack unfolds

An attacker with local access loads the siw module and invokes RDMA memory registration in a way that forces xa_alloc_cyclic to fail inside siw_mr_add_mem, triggering the kfree while mr->mem still references the freed object; subsequent error handling in siw_alloc_mr then uses the dangling pointer.

How to fix it

Apply the upstream fix that moves the mr->mem assignment after the xa_alloc_cyclic check; update to a Linux kernel containing the resolution for CVE-2021-47012.

How to confirm the fix worked

Confirm the siw driver source contains the corrected assignment order; verify the running kernel version includes the patch or test memory-registration error paths under fault injection.

Typical attack path

1. Load or ensure siw RDMA driver is present
2. Issue RDMA memory registration calls that reach siw_alloc_mr
3. Force xa_alloc_cyclic failure inside siw_mr_add_mem
4. Trigger error path that calls siw_mr_drop_mem on the now-freed mr->mem
5. Observe kernel crash or attempt to leverage freed memory for code execution

How to detect it

Review kernel logs for oops or panic traces referencing siw_alloc_mr or siw_mr_drop_mem; inspect audit logs for unusual RDMA memory registration attempts by untrusted processes.

What your security team should do

• Prioritize kernel updates on systems exposing RDMA/siw interfaces
• Restrict unprivileged access to RDMA verbs until patched
• Monitor for kernel oops or panic logs involving siw_mr_drop_mem
• Apply defense-in-depth with kernel hardening features such as KASAN or hardened allocators where available