CVE-2024-47750

What it actually does

Use-after-free of rsv_qp resource in RDMA/hns driver on HIP08 hardware because the QP is released before ib_unregister_device completes, allowing concurrent MR deregistration to reference the freed object.

Why it matters to the business

Systems using affected HIP08 RDMA hardware risk kernel instability or memory corruption that can lead to crashes, denial of service, or potential local privilege escalation until the kernel is updated.

How an attack unfolds

An attacker with local access triggers RDMA memory registration and deregistration operations during the window after rsv_qp is freed but before device unregistration; the kernel then accesses the dangling QP pointer, resulting in a use-after-free that can be leveraged for memory corruption.

How to fix it

Update the Linux kernel to a version containing commit 2ccf1c75d39949d8ea043d04a2e92d7100ea723d or later; ensure the rsv_qp release occurs after ib_unregister_device.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than the vulnerable versions; confirm ib_unregister_device is called before rsv_qp release in the hns driver code; test RDMA device unload and MR deregistration paths for absence of UAF reports.

Typical attack path

1. Obtain local access on a system with HIP08 RDMA hardware running an affected kernel
2. Perform RDMA operations that cause rsv_qp allocation
3. Trigger the device teardown path that frees rsv_qp early
4. Issue MR deregistration calls that reuse the freed rsv_qp
5. Exploit the resulting use-after-free for memory corruption or control-flow hijacking

How to detect it

Review kernel logs for use-after-free or slab corruption messages involving RDMA or hns driver objects; inspect audit logs for unusual RDMA device unload or MR deregistration activity around the time of any kernel faults.

What your security team should do

• Apply the kernel update containing the referenced commit as soon as possible on all systems with HIP08 RDMA hardware
• Restrict unprivileged local access to RDMA interfaces until patched
• Monitor for kernel oops or slab-use-after-free warnings related to RDMA resources