CVE-2024-47695

What it actually does

Out-of-bounds memory access in init_conns() cleanup loop after create_con/create_cm failure; cid initialized to clt_path->s.con_num instead of con_num-1 causes access beyond allocated connection array bounds.

Why it matters to the business

Systems using RDMA/RTRS client paths may experience crashes, memory corruption, or denial of service; high ecosystem prevalence of Linux kernel increases exposure for storage and high-performance networking workloads; no immediate ransomware linkage but listed in broad 2024 zero-day espionage and financial campaigns.

How an attack unfolds

Attacker triggers connection setup failure in init_conns(), then forces cleanup loop to read/write past array bounds; listed threat actors in zero-day and Linux OOB campaigns may chain this for kernel-level compromise or information disclosure.

How to fix it

Update Linux kernel to a version containing the fix that resets cid to con_num-1 before the cleanup loop; apply vendor backports for affected distributions; note that listed activerecord fixes are unrelated to this kernel issue.

How to confirm the fix worked

Confirm kernel version contains commit resetting cid in init_conns(); review dmesg or kernel logs for prior OOB warnings; test RDMA connection teardown under failure injection.

Typical attack path

1. Identify target systems with RDMA/RTRS client enabled
2. Trigger create_con or create_cm failure path
3. Force execution of subsequent destroy-tag cleanup loop
4. Access out-of-bounds memory via incorrect cid value
5. Achieve crash, corruption, or further kernel exploitation

How to detect it

Search kernel logs and audit trails for RDMA/rtrs-clt init_conns errors or OOB warnings; correlate with process crashes in RDMA paths; review for activity from listed espionage or financial actors exploiting Linux OOB issues.

What your security team should do

• Prioritize kernel updates on all RDMA-enabled hosts before any CISA-style deadlines
• Monitor EPSS trend and threat actor reports for exploitation spikes
• Disable RDMA/RTRS where not required as temporary mitigation
• Audit logs for RDMA connection setup failures followed by crashes