CVE-2021-47292

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47292
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix memleak in io_init_wq_offload() I got memory leak report when doing fuzz test: BUG: memory leak unreferenced object 0xffff888107310a80 (size 96): comm "syz-executor.6", pid 4610, jiffies 4295140240 (age 20.135s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... backtrace: [<000000001974933b>] kmalloc include/linux/slab.h:591 [inline] [<000000001974933b>] kzalloc include/linux/slab.h:721 [inline] [<000000001974933b>] io_init_wq_offload fs/io_uring.c:7920 [inline] [<000000001974933b>] io_uring_alloc_task_context+0x466/0x640 fs/io_uring.c:7955 [<0000000039d0800d>] __io_uring_add_tctx_node+0x256/0x360 fs/io_uring.c:9016 [<000000008482e78c>] io_uring_add_tctx_node fs/io_uring.c:9052 [inline] [<000000008482e78c>] __do_sys_io_uring_enter fs/io_uring.c:9354 [inline] [<000000008482e78c>] __se_sys_io_uring_enter fs/io_uring.c:9301 [inline] [<000000008482e78c>] __x64_sys_io_uring_enter+0xabc/0xc20 fs/io_uring.c:9301 [<00000000b875f18f>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<00000000b875f18f>] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 [<000000006b0a8484>] entry_SYSCALL_64_after_hwframe+0x44/0xae CPU0 CPU1 io_uring_enter io_uring_enter io_uring_add_tctx_node io_uring_add_tctx_node __io_uring_add_tctx_node __io_uring_add_tctx_node io_uring_alloc_task_context io_uring_alloc_task_context io_init_wq_offload io_init_wq_offload hash = kzalloc hash = kzalloc ctx->hash_map = hash ctx->hash_map = hash <- one of the hash is leaked When calling io_uring_enter() in parallel, the 'hash_map' will be leaked, add uring_lock to protect 'hash_map'.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/362a9e65289284f36403058eea2462d0330c1f24 Patch
https://git.kernel.org/stable/c/502731a03f27cba1513fbbff77e508185ffce5bb Patch
https://git.kernel.org/stable/c/362a9e65289284f36403058eea2462d0330c1f24 Patch
https://git.kernel.org/stable/c/502731a03f27cba1513fbbff77e508185ffce5bb Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.14:rc2:*:*:*:*:*:*
History

23 Dec 2024, 16:58

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CWE CWE-401
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/362a9e65289284f36403058eea2462d0330c1f24 - () https://git.kernel.org/stable/c/362a9e65289284f36403058eea2462d0330c1f24 - Patch
References () https://git.kernel.org/stable/c/502731a03f27cba1513fbbff77e508185ffce5bb - () https://git.kernel.org/stable/c/502731a03f27cba1513fbbff77e508185ffce5bb - Patch
CPE cpe:2.3:o:linux:linux_kernel:5.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

21 Nov 2024, 06:35

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/362a9e65289284f36403058eea2462d0330c1f24 - () https://git.kernel.org/stable/c/362a9e65289284f36403058eea2462d0330c1f24 -
References () https://git.kernel.org/stable/c/502731a03f27cba1513fbbff77e508185ffce5bb - () https://git.kernel.org/stable/c/502731a03f27cba1513fbbff77e508185ffce5bb -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: io_uring: corrige memleak en io_init_wq_offload(). Recibí un informe de pérdida de memoria al realizar la prueba fuzz: BUG: pérdida de memoria objeto sin referencia 0xffff888107310a80 (tamaño 96): comm "syz-executor.6" , pid 4610, sjiffies 4295140240 (edad 20,135 s) volcado hexadecimal (primeros 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................. 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... backtrace: [&lt;000000001974933b&gt;] kmalloc include/linux/slab.h:591 [en línea] [&lt;000000001974933b&gt;] kzalloc include/linux/slab.h:721 [en línea] [&lt;000000001974933b&gt;] io_init_wq_offload fs/io_uring.c:7920 [en línea] [&lt;000000001974933b&gt;] _context+0x466/0x640 fs/io_uring .c:7955 [&lt;0000000039d0800d&gt;] __io_uring_add_tctx_node+0x256/0x360 fs/io_uring.c:9016 [&lt;000000008482e78c&gt;] io_uring_add_tctx_node fs/io_uring.c:9052 [en línea] 0000008482e78c&gt;] __do_sys_io_uring_enter fs/io_uring.c:9354 [en línea] [&lt;000000008482e78c&gt;] __se_sys_io_uring_enter fs/io_uring.c:9301 [en línea] [&lt;000000008482e78c&gt;] __x64_sys_io_uring_enter+0xabc/0xc20 fs/io_uring.c:9301 [&lt;00000000b 875f18f&gt;] do_syscall_x64 arch/x86/entry/common. c:50 [en línea] [&lt;00000000b875f18f&gt;] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 [&lt;000000006b0a8484&gt;] Entry_SYSCALL_64_after_hwframe+0x44/0xae CPU0 CPU1 io_uring_enter io_uring_enter io_uring_add_tctx_node io_uring_add_tctx_node __io_uring_add_tctx_node __io_uring_add_tctx_node io_uring_alloc_task_context io_uring_alloc_task_context io_init_wq_offload io_init_wq_offload hash = kzalloc hash = kzalloc ctx-&gt;hash_map = hash ctx-&gt;hash_map = hash &lt;- uno de los hash se filtra Al llamar a io_uring_enter() en paralelo, se filtrará el 'hash_map', agregue uring_lock para proteger 'hash_map'.

21 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-21 15:15

Updated : 2024-12-23 16:58

NVD link : CVE-2021-47292

Mitre link : CVE-2021-47292

CVE.ORG link : CVE-2021-47292

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime