fkie_cve-2021-47462
Vulnerability from fkie_nvd
Published
2024-05-22 07:15
Modified
2025-02-03 15:46
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: do not allow illegal MPOL_F_NUMA_BALANCING | MPOL_LOCAL in mbind() syzbot reported access to unitialized memory in mbind() [1] Issue came with commit bda420b98505 ("numa balancing: migrate on fault among multiple bound nodes") This commit added a new bit in MPOL_MODE_FLAGS, but only checked valid combination (MPOL_F_NUMA_BALANCING can only be used with MPOL_BIND) in do_set_mempolicy() This patch moves the check in sanitize_mpol_flags() so that it is also used by mbind() [1] BUG: KMSAN: uninit-value in __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h:105 [inline] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_alloc_node mm/slub.c:3221 [inline] slab_alloc mm/slub.c:3230 [inline] kmem_cache_alloc+0x751/0xff0 mm/slub.c:3235 mpol_new mm/mempolicy.c:293 [inline] do_mbind+0x912/0x15f0 mm/mempolicy.c:1289 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae ===================================================== Kernel panic - not syncing: panic_on_kmsan set ... CPU: 0 PID: 15049 Comm: syz-executor.0 Tainted: G B 5.15.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1ff/0x28e lib/dump_stack.c:106 dump_stack+0x25/0x28 lib/dump_stack.c:113 panic+0x44f/0xdeb kernel/panic.c:232 kmsan_report+0x2ee/0x300 mm/kmsan/report.c:186 __msan_warning+0xd7/0x150 mm/kmsan/instrumentation.c:208 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h:105 [inline] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6d2aec9e123bb9c49cb5c7fc654f25f81e688e8cPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9ee4e9ae98f1f262d6fae0d266cfdf3ba2c321d9Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/6d2aec9e123bb9c49cb5c7fc654f25f81e688e8cPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/9ee4e9ae98f1f262d6fae0d266cfdf3ba2c321d9Patch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel 5.15
linux linux_kernel 5.15
linux linux_kernel 5.15
linux linux_kernel 5.15
linux linux_kernel 5.15
linux linux_kernel 5.15


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CFEAA14C-4860-49B1-9532-8AFC5E1BDEF5",
              "versionEndExcluding": "5.14.15",
              "versionStartIncluding": "5.12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "E46C74C6-B76B-4C94-A6A4-FD2FFF62D644",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "60134C3A-06E4-48C1-B04F-2903732A4E56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "0460DA88-8FE1-46A2-9DDA-1F1ABA552E71",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "AF55383D-4DF2-45DC-93F7-571F4F978EAB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "9E9481B2-8AA6-4CBD-B5D3-C10F51FF6D01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "EBD45831-4B79-42BC-ABC0-86870F0DEA89",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempolicy: do not allow illegal MPOL_F_NUMA_BALANCING | MPOL_LOCAL in mbind()\n\nsyzbot reported access to unitialized memory in mbind() [1]\n\nIssue came with commit bda420b98505 (\"numa balancing: migrate on fault\namong multiple bound nodes\")\n\nThis commit added a new bit in MPOL_MODE_FLAGS, but only checked valid\ncombination (MPOL_F_NUMA_BALANCING can only be used with MPOL_BIND) in\ndo_set_mempolicy()\n\nThis patch moves the check in sanitize_mpol_flags() so that it is also\nused by mbind()\n\n  [1]\n  BUG: KMSAN: uninit-value in __mpol_equal+0x567/0x590 mm/mempolicy.c:2260\n   __mpol_equal+0x567/0x590 mm/mempolicy.c:2260\n   mpol_equal include/linux/mempolicy.h:105 [inline]\n   vma_merge+0x4a1/0x1e60 mm/mmap.c:1190\n   mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811\n   do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333\n   kernel_mbind mm/mempolicy.c:1483 [inline]\n   __do_sys_mbind mm/mempolicy.c:1490 [inline]\n   __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486\n   __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486\n   do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n   do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n  Uninit was created at:\n   slab_alloc_node mm/slub.c:3221 [inline]\n   slab_alloc mm/slub.c:3230 [inline]\n   kmem_cache_alloc+0x751/0xff0 mm/slub.c:3235\n   mpol_new mm/mempolicy.c:293 [inline]\n   do_mbind+0x912/0x15f0 mm/mempolicy.c:1289\n   kernel_mbind mm/mempolicy.c:1483 [inline]\n   __do_sys_mbind mm/mempolicy.c:1490 [inline]\n   __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486\n   __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486\n   do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n   do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n  =====================================================\n  Kernel panic - not syncing: panic_on_kmsan set ...\n  CPU: 0 PID: 15049 Comm: syz-executor.0 Tainted: G    B             5.15.0-rc2-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n  Call Trace:\n   __dump_stack lib/dump_stack.c:88 [inline]\n   dump_stack_lvl+0x1ff/0x28e lib/dump_stack.c:106\n   dump_stack+0x25/0x28 lib/dump_stack.c:113\n   panic+0x44f/0xdeb kernel/panic.c:232\n   kmsan_report+0x2ee/0x300 mm/kmsan/report.c:186\n   __msan_warning+0xd7/0x150 mm/kmsan/instrumentation.c:208\n   __mpol_equal+0x567/0x590 mm/mempolicy.c:2260\n   mpol_equal include/linux/mempolicy.h:105 [inline]\n   vma_merge+0x4a1/0x1e60 mm/mmap.c:1190\n   mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811\n   do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333\n   kernel_mbind mm/mempolicy.c:1483 [inline]\n   __do_sys_mbind mm/mempolicy.c:1490 [inline]\n   __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486\n   __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486\n   do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n   do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n   entry_SYSCALL_64_after_hwframe+0x44/0xae"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: mm/mempolicy: no permitir MPOL_F_NUMA_BALANCING ilegal | MPOL_LOCAL en mbind() syzbot inform\u00f3 acceso a la memoria unificada en mbind() [1] El problema surgi\u00f3 con el commit bda420b98505 (\"equilibrio numa: migrar en caso de falla entre m\u00faltiples nodos vinculados\") Esta confirmaci\u00f3n agreg\u00f3 un nuevo bit en MPOL_MODE_FLAGS, pero solo marc\u00f3 que era v\u00e1lido combinaci\u00f3n (MPOL_F_NUMA_BALANCING solo se puede usar con MPOL_BIND) en do_set_mempolicy() Este parche mueve la verificaci\u00f3n en sanitize_mpol_flags() para que tambi\u00e9n sea usado por mbind() [1] ERROR: KMSAN: valor uninit en __mpol_equal+0x567/0x590 mm /mempolicy.c:2260 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h:105 [en l\u00ednea] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/ mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [en l\u00ednea] __do_sys_mbind mm/mempolicy.c:1490 [en l\u00ednea] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c: 1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [en l\u00ednea] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 Entry_SYSCALL_64_after_hwframe+0 Unidad x44/0xae fue creado en: slab_alloc_node mm/slub.c:3221 [en l\u00ednea] slab_alloc mm/slub.c:3230 [en l\u00ednea] kmem_cache_alloc+0x751/0xff0 mm/slub.c:3235 mpol_new mm/mempolicy.c:293 [en l\u00ednea] do_mbind +0x912/0x15f0 mm/mempolicy.c:1289 kernel_mbind mm/mempolicy.c:1483 [en l\u00ednea] __do_sys_mbind mm/mempolicy.c:1490 [en l\u00ednea] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0 x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [en l\u00ednea] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 Entry_SYSCALL_64_after_hwframe+0x44/0xae ======= =============================================== P\u00e1nico del kernel - no sincronizaci\u00f3n: p\u00e1nico_on_kmsan set... CPU: 0 PID: 15049 Comm: syz-executor.0 Contaminado: GB 5.15.0-rc2-syzkaller #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/ Seguimiento de llamadas de 2011: __dump_stack lib/dump_stack.c:88 [en l\u00ednea] dump_stack_lvl+0x1ff/0x28e lib/dump_stack.c:106 dump_stack+0x25/0x28 lib/dump_stack.c:113 p\u00e1nico+0x44f/0xdeb kernel/panic.c: 232 kmsan_report+0x2ee/0x300 mm/kmsan/report.c:186 __msan_warning+0xd7/0x150 mm/kmsan/instrumentation.c:208 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h: 105 [en l\u00ednea] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [en l\u00ednea ] __do_sys_mbind mm/mempolicy.c:1490 [en l\u00ednea] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common. c:51 [en l\u00ednea ] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 Entry_SYSCALL_64_after_hwframe+0x44/0xae"
    }
  ],
  "id": "CVE-2021-47462",
  "lastModified": "2025-02-03T15:46:30.700",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-05-22T07:15:11.117",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/6d2aec9e123bb9c49cb5c7fc654f25f81e688e8c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/9ee4e9ae98f1f262d6fae0d266cfdf3ba2c321d9"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/6d2aec9e123bb9c49cb5c7fc654f25f81e688e8c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/9ee4e9ae98f1f262d6fae0d266cfdf3ba2c321d9"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-908"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.