CVE-2021-47317

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47317
In the Linux kernel, the following vulnerability has been resolved: powerpc/bpf: Fix detecting BPF atomic instructions Commit 91c960b0056672 ("bpf: Rename BPF_XADD and prepare to encode other atomics in .imm") converted BPF_XADD to BPF_ATOMIC and added a way to distinguish instructions based on the immediate field. Existing JIT implementations were updated to check for the immediate field and to reject programs utilizing anything more than BPF_ADD (such as BPF_FETCH) in the immediate field. However, the check added to powerpc64 JIT did not look at the correct BPF instruction. Due to this, such programs would be accepted and incorrectly JIT'ed resulting in soft lockups, as seen with the atomic bounds test. Fix this by looking at the correct immediate value.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0d435b6d94b05dcfd836d758a63145aa566618e2 Patch
https://git.kernel.org/stable/c/419ac821766cbdb9fd85872bb3f1a589df05c94c Patch
https://git.kernel.org/stable/c/7284dab07e4d51d453cc42851fae9ec4fac6ef2f Patch
https://git.kernel.org/stable/c/0d435b6d94b05dcfd836d758a63145aa566618e2 Patch
https://git.kernel.org/stable/c/419ac821766cbdb9fd85872bb3f1a589df05c94c Patch
https://git.kernel.org/stable/c/7284dab07e4d51d453cc42851fae9ec4fac6ef2f Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

12 May 2025, 19:59

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 3.3
CWE CWE-667
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/0d435b6d94b05dcfd836d758a63145aa566618e2 - () https://git.kernel.org/stable/c/0d435b6d94b05dcfd836d758a63145aa566618e2 - Patch
References () https://git.kernel.org/stable/c/419ac821766cbdb9fd85872bb3f1a589df05c94c - () https://git.kernel.org/stable/c/419ac821766cbdb9fd85872bb3f1a589df05c94c - Patch
References () https://git.kernel.org/stable/c/7284dab07e4d51d453cc42851fae9ec4fac6ef2f - () https://git.kernel.org/stable/c/7284dab07e4d51d453cc42851fae9ec4fac6ef2f - Patch

21 Nov 2024, 06:35

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0d435b6d94b05dcfd836d758a63145aa566618e2 - () https://git.kernel.org/stable/c/0d435b6d94b05dcfd836d758a63145aa566618e2 -
References () https://git.kernel.org/stable/c/419ac821766cbdb9fd85872bb3f1a589df05c94c - () https://git.kernel.org/stable/c/419ac821766cbdb9fd85872bb3f1a589df05c94c -
References () https://git.kernel.org/stable/c/7284dab07e4d51d453cc42851fae9ec4fac6ef2f - () https://git.kernel.org/stable/c/7284dab07e4d51d453cc42851fae9ec4fac6ef2f -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: powerpc/bpf: Corrección de la detección de instrucciones atómicas BPF. La confirmación 91c960b0056672 ("bpf: Renombrar BPF_XADD y prepararse para codificar otros átomos en .imm") convirtió BPF_XADD a BPF_ATOMIC y agregó una forma de distinguir instrucciones basadas en el campo inmediato. Las implementaciones JIT existentes se actualizaron para verificar el campo inmediato y rechazar programas que utilicen algo más que BPF_ADD (como BPF_FETCH) en el campo inmediato. Sin embargo, la verificación agregada a powerpc64 JIT no analizó la instrucción BPF correcta. Debido a esto, dichos programas serían aceptados y sometidos a JIT incorrectamente, lo que provocaría bloqueos suaves, como se ve con la prueba de límites atómicos. Solucione este problema observando el valor inmediato correcto.

21 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-21 15:15

Updated : 2025-05-12 19:59

NVD link : CVE-2021-47317

Mitre link : CVE-2021-47317

CVE.ORG link : CVE-2021-47317

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-667

Improper Locking