CVE-2021-46935

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-46935
In the Linux kernel, the following vulnerability has been resolved: binder: fix async_free_space accounting for empty parcels In 4.13, commit 74310e06be4d ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are the same except for this corner case of asynchronous transactions with payloads < 8 bytes.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/103b16a8c51f96d5fe063022869ea906c256e5da Patch
https://git.kernel.org/stable/c/17691bada6b2f1d5f1c0f6d28cd9d0727023b0ff Patch
https://git.kernel.org/stable/c/1cb8444f3114f0bb2f6e3bcadcf09aa4a28425d4 Patch
https://git.kernel.org/stable/c/2d2df539d05205fd83c404d5f2dff48d36f9b495 Patch
https://git.kernel.org/stable/c/7c7064402609aeb6fb11be1b4ec10673ff17b593 Patch
https://git.kernel.org/stable/c/cfd0d84ba28c18b531648c9d4a35ecca89ad9901 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

10 Apr 2024, 18:24

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CWE CWE-668
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/103b16a8c51f96d5fe063022869ea906c256e5da - () https://git.kernel.org/stable/c/103b16a8c51f96d5fe063022869ea906c256e5da - Patch
References () https://git.kernel.org/stable/c/17691bada6b2f1d5f1c0f6d28cd9d0727023b0ff - () https://git.kernel.org/stable/c/17691bada6b2f1d5f1c0f6d28cd9d0727023b0ff - Patch
References () https://git.kernel.org/stable/c/1cb8444f3114f0bb2f6e3bcadcf09aa4a28425d4 - () https://git.kernel.org/stable/c/1cb8444f3114f0bb2f6e3bcadcf09aa4a28425d4 - Patch
References () https://git.kernel.org/stable/c/2d2df539d05205fd83c404d5f2dff48d36f9b495 - () https://git.kernel.org/stable/c/2d2df539d05205fd83c404d5f2dff48d36f9b495 - Patch
References () https://git.kernel.org/stable/c/7c7064402609aeb6fb11be1b4ec10673ff17b593 - () https://git.kernel.org/stable/c/7c7064402609aeb6fb11be1b4ec10673ff17b593 - Patch
References () https://git.kernel.org/stable/c/cfd0d84ba28c18b531648c9d4a35ecca89ad9901 - () https://git.kernel.org/stable/c/cfd0d84ba28c18b531648c9d4a35ecca89ad9901 - Patch

27 Feb 2024, 14:20

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: binder: corrige la contabilidad async_free_space para paquetes vacíos En 4.13, el commit 74310e06be4d ("android: binder: mover el búfer fuera del área compartida con el espacio del usuario") solucionó un problema de visibilidad de la estructura del kernel. Como parte de ese parche, se usó sizeof(void *) como tamaño de búfer para cargas de datos de longitud 0, de modo que el controlador pudiera detectar clientes abusivos que enviaran transacciones asincrónicas de longitud 0 a un servidor imponiendo límites en async_free_size. Desafortunadamente, en el lado "libre", la contabilidad de async_free_space no volvió a agregar el tamaño de (void *). El resultado fue que se filtraron hasta 8 bytes de async_free_space en cada transacción asíncrona de 8 bytes o menos. Estas pequeñas transacciones son poco comunes, por lo que este problema contable ha pasado desapercibido durante varios años. La solución es utilizar "buffer_size" (el tamaño del búfer asignado) en lugar de "size" (el tamaño del búfer lógico) al actualizar async_free_space durante la operación libre. Son iguales excepto por este caso de esquina de transacciones asincrónicas con payloads &lt;8 bytes.

27 Feb 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-27 10:15

Updated : 2024-04-10 18:24

NVD link : CVE-2021-46935

Mitre link : CVE-2021-46935

CVE.ORG link : CVE-2021-46935

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-668

Exposure of Resource to Wrong Sphere