CVE-2021-47435 (GCVE-0-2021-47435)
Vulnerability from cvelistv5 – Published: 2024-05-22 06:19 – Updated: 2026-05-11 13:54
VLAI
EPSS
VEX
Title
dm: fix mempool NULL pointer race when completing IO
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm: fix mempool NULL pointer race when completing IO
dm_io_dec_pending() calls end_io_acct() first and will then dec md
in-flight pending count. But if a task is swapping DM table at same
time this can result in a crash due to mempool->elements being NULL:
task1 task2
do_resume
->do_suspend
->dm_wait_for_completion
bio_endio
->clone_endio
->dm_io_dec_pending
->end_io_acct
->wakeup task1
->dm_swap_table
->__bind
->__bind_mempools
->bioset_exit
->mempool_exit
->free_io
[ 67.330330] Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000000
......
[ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO)
[ 67.330510] pc : mempool_free+0x70/0xa0
[ 67.330515] lr : mempool_free+0x4c/0xa0
[ 67.330520] sp : ffffff8008013b20
[ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004
[ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8
[ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800
[ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800
[ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80
[ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c
[ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd
[ 67.330563] x15: 000000000093b41e x14: 0000000000000010
[ 67.330569] x13: 0000000000007f7a x12: 0000000034155555
[ 67.330574] x11: 0000000000000001 x10: 0000000000000001
[ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000
[ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a
[ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001
[ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8
[ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970
[ 67.330609] Call trace:
[ 67.330616] mempool_free+0x70/0xa0
[ 67.330627] bio_put+0xf8/0x110
[ 67.330638] dec_pending+0x13c/0x230
[ 67.330644] clone_endio+0x90/0x180
[ 67.330649] bio_endio+0x198/0x1b8
[ 67.330655] dec_pending+0x190/0x230
[ 67.330660] clone_endio+0x90/0x180
[ 67.330665] bio_endio+0x198/0x1b8
[ 67.330673] blk_update_request+0x214/0x428
[ 67.330683] scsi_end_request+0x2c/0x300
[ 67.330688] scsi_io_completion+0xa0/0x710
[ 67.330695] scsi_finish_command+0xd8/0x110
[ 67.330700] scsi_softirq_done+0x114/0x148
[ 67.330708] blk_done_softirq+0x74/0xd0
[ 67.330716] __do_softirq+0x18c/0x374
[ 67.330724] irq_exit+0xb4/0xb8
[ 67.330732] __handle_domain_irq+0x84/0xc0
[ 67.330737] gic_handle_irq+0x148/0x1b0
[ 67.330744] el1_irq+0xe8/0x190
[ 67.330753] lpm_cpuidle_enter+0x4f8/0x538
[ 67.330759] cpuidle_enter_state+0x1fc/0x398
[ 67.330764] cpuidle_enter+0x18/0x20
[ 67.330772] do_idle+0x1b4/0x290
[ 67.330778] cpu_startup_entry+0x20/0x28
[ 67.330786] secondary_start_kernel+0x160/0x170
Fix this by:
1) Establishing pointers to 'struct dm_io' members in
dm_io_dec_pending() so that they may be passed into end_io_acct()
_after_ free_io() is called.
2) Moving end_io_acct() after free_io().
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-22 18:48 UTC
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
6a8736d10cb413be95ea443ba40f25c93f4ef9b2 , < 9fb7cd5c7fef0f1c982e3cd27745a0dec260eaed
(git)
Affected: 6a8736d10cb413be95ea443ba40f25c93f4ef9b2 , < d35aef9c60d310eff3eaddacce301efe877e2b7c (git) Affected: 6a8736d10cb413be95ea443ba40f25c93f4ef9b2 , < 9e07272cca2ed76f7f6073f4444b1143828c8d87 (git) Affected: 6a8736d10cb413be95ea443ba40f25c93f4ef9b2 , < ad1393b92e5059218d055bfec8f4946d85ad04c4 (git) Affected: 6a8736d10cb413be95ea443ba40f25c93f4ef9b2 , < d29c78d3f9c5d2604548c1065bf1ec212728ea61 (git) Affected: 6a8736d10cb413be95ea443ba40f25c93f4ef9b2 , < 6e506f07c5b561d673dd0b0d8f7f420cc48024fb (git) Affected: 6a8736d10cb413be95ea443ba40f25c93f4ef9b2 , < d208b89401e073de986dc891037c5a668f5d5d95 (git) |
guessed | |
| Linux | Linux |
Affected:
2.6.37
Unaffected: 0 , < 2.6.37 (semver) Unaffected: 4.9.313 , ≤ 4.9.* (semver) Unaffected: 4.14.278 , ≤ 4.14.* (semver) Unaffected: 4.19.242 , ≤ 4.19.* (semver) Unaffected: 5.4.193 , ≤ 5.4.* (semver) Unaffected: 5.10.113 , ≤ 5.10.* (semver) Unaffected: 5.14.14 , ≤ 5.14.* (semver) Unaffected: 5.15 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-22T18:48:43.435062Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:13:25.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:39:59.225Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/9fb7cd5c7fef0f1c982e3cd27745a0dec260eaed"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/d35aef9c60d310eff3eaddacce301efe877e2b7c"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/9e07272cca2ed76f7f6073f4444b1143828c8d87"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/ad1393b92e5059218d055bfec8f4946d85ad04c4"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/d29c78d3f9c5d2604548c1065bf1ec212728ea61"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/6e506f07c5b561d673dd0b0d8f7f420cc48024fb"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/d208b89401e073de986dc891037c5a668f5d5d95"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9fb7cd5c7fef0f1c982e3cd27745a0dec260eaed",
"status": "affected",
"version": "6a8736d10cb413be95ea443ba40f25c93f4ef9b2",
"versionType": "git"
},
{
"lessThan": "d35aef9c60d310eff3eaddacce301efe877e2b7c",
"status": "affected",
"version": "6a8736d10cb413be95ea443ba40f25c93f4ef9b2",
"versionType": "git"
},
{
"lessThan": "9e07272cca2ed76f7f6073f4444b1143828c8d87",
"status": "affected",
"version": "6a8736d10cb413be95ea443ba40f25c93f4ef9b2",
"versionType": "git"
},
{
"lessThan": "ad1393b92e5059218d055bfec8f4946d85ad04c4",
"status": "affected",
"version": "6a8736d10cb413be95ea443ba40f25c93f4ef9b2",
"versionType": "git"
},
{
"lessThan": "d29c78d3f9c5d2604548c1065bf1ec212728ea61",
"status": "affected",
"version": "6a8736d10cb413be95ea443ba40f25c93f4ef9b2",
"versionType": "git"
},
{
"lessThan": "6e506f07c5b561d673dd0b0d8f7f420cc48024fb",
"status": "affected",
"version": "6a8736d10cb413be95ea443ba40f25c93f4ef9b2",
"versionType": "git"
},
{
"lessThan": "d208b89401e073de986dc891037c5a668f5d5d95",
"status": "affected",
"version": "6a8736d10cb413be95ea443ba40f25c93f4ef9b2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.313",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.278",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.242",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.193",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.14.*",
"status": "unaffected",
"version": "5.14.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.313",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.278",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.242",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.193",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.113",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.14",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix mempool NULL pointer race when completing IO\n\ndm_io_dec_pending() calls end_io_acct() first and will then dec md\nin-flight pending count. But if a task is swapping DM table at same\ntime this can result in a crash due to mempool-\u003eelements being NULL:\n\ntask1 task2\ndo_resume\n -\u003edo_suspend\n -\u003edm_wait_for_completion\n bio_endio\n\t\t\t\t -\u003eclone_endio\n\t\t\t\t -\u003edm_io_dec_pending\n\t\t\t\t -\u003eend_io_acct\n\t\t\t\t -\u003ewakeup task1\n -\u003edm_swap_table\n -\u003e__bind\n -\u003e__bind_mempools\n -\u003ebioset_exit\n -\u003emempool_exit\n -\u003efree_io\n\n[ 67.330330] Unable to handle kernel NULL pointer dereference at\nvirtual address 0000000000000000\n......\n[ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO)\n[ 67.330510] pc : mempool_free+0x70/0xa0\n[ 67.330515] lr : mempool_free+0x4c/0xa0\n[ 67.330520] sp : ffffff8008013b20\n[ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004\n[ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8\n[ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800\n[ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800\n[ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80\n[ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c\n[ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd\n[ 67.330563] x15: 000000000093b41e x14: 0000000000000010\n[ 67.330569] x13: 0000000000007f7a x12: 0000000034155555\n[ 67.330574] x11: 0000000000000001 x10: 0000000000000001\n[ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000\n[ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a\n[ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001\n[ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8\n[ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970\n[ 67.330609] Call trace:\n[ 67.330616] mempool_free+0x70/0xa0\n[ 67.330627] bio_put+0xf8/0x110\n[ 67.330638] dec_pending+0x13c/0x230\n[ 67.330644] clone_endio+0x90/0x180\n[ 67.330649] bio_endio+0x198/0x1b8\n[ 67.330655] dec_pending+0x190/0x230\n[ 67.330660] clone_endio+0x90/0x180\n[ 67.330665] bio_endio+0x198/0x1b8\n[ 67.330673] blk_update_request+0x214/0x428\n[ 67.330683] scsi_end_request+0x2c/0x300\n[ 67.330688] scsi_io_completion+0xa0/0x710\n[ 67.330695] scsi_finish_command+0xd8/0x110\n[ 67.330700] scsi_softirq_done+0x114/0x148\n[ 67.330708] blk_done_softirq+0x74/0xd0\n[ 67.330716] __do_softirq+0x18c/0x374\n[ 67.330724] irq_exit+0xb4/0xb8\n[ 67.330732] __handle_domain_irq+0x84/0xc0\n[ 67.330737] gic_handle_irq+0x148/0x1b0\n[ 67.330744] el1_irq+0xe8/0x190\n[ 67.330753] lpm_cpuidle_enter+0x4f8/0x538\n[ 67.330759] cpuidle_enter_state+0x1fc/0x398\n[ 67.330764] cpuidle_enter+0x18/0x20\n[ 67.330772] do_idle+0x1b4/0x290\n[ 67.330778] cpu_startup_entry+0x20/0x28\n[ 67.330786] secondary_start_kernel+0x160/0x170\n\nFix this by:\n1) Establishing pointers to \u0027struct dm_io\u0027 members in\ndm_io_dec_pending() so that they may be passed into end_io_acct()\n_after_ free_io() is called.\n2) Moving end_io_acct() after free_io()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T13:54:38.987Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9fb7cd5c7fef0f1c982e3cd27745a0dec260eaed"
},
{
"url": "https://git.kernel.org/stable/c/d35aef9c60d310eff3eaddacce301efe877e2b7c"
},
{
"url": "https://git.kernel.org/stable/c/9e07272cca2ed76f7f6073f4444b1143828c8d87"
},
{
"url": "https://git.kernel.org/stable/c/ad1393b92e5059218d055bfec8f4946d85ad04c4"
},
{
"url": "https://git.kernel.org/stable/c/d29c78d3f9c5d2604548c1065bf1ec212728ea61"
},
{
"url": "https://git.kernel.org/stable/c/6e506f07c5b561d673dd0b0d8f7f420cc48024fb"
},
{
"url": "https://git.kernel.org/stable/c/d208b89401e073de986dc891037c5a668f5d5d95"
}
],
"title": "dm: fix mempool NULL pointer race when completing IO",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47435",
"datePublished": "2024-05-22T06:19:31.562Z",
"dateReserved": "2024-05-21T14:58:30.830Z",
"dateUpdated": "2026-05-11T13:54:38.987Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-47435",
"date": "2026-09-15",
"epss": "0.00239",
"percentile": "0.1502"
},
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm: fix mempool NULL pointer race when completing IO\\n\\ndm_io_dec_pending() calls end_io_acct() first and will then dec md\\nin-flight pending count. But if a task is swapping DM table at same\\ntime this can result in a crash due to mempool-\u003eelements being NULL:\\n\\ntask1 task2\\ndo_resume\\n -\u003edo_suspend\\n -\u003edm_wait_for_completion\\n bio_endio\\n\\t\\t\\t\\t -\u003eclone_endio\\n\\t\\t\\t\\t -\u003edm_io_dec_pending\\n\\t\\t\\t\\t -\u003eend_io_acct\\n\\t\\t\\t\\t -\u003ewakeup task1\\n -\u003edm_swap_table\\n -\u003e__bind\\n -\u003e__bind_mempools\\n -\u003ebioset_exit\\n -\u003emempool_exit\\n -\u003efree_io\\n\\n[ 67.330330] Unable to handle kernel NULL pointer dereference at\\nvirtual address 0000000000000000\\n......\\n[ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO)\\n[ 67.330510] pc : mempool_free+0x70/0xa0\\n[ 67.330515] lr : mempool_free+0x4c/0xa0\\n[ 67.330520] sp : ffffff8008013b20\\n[ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004\\n[ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8\\n[ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800\\n[ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800\\n[ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80\\n[ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c\\n[ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd\\n[ 67.330563] x15: 000000000093b41e x14: 0000000000000010\\n[ 67.330569] x13: 0000000000007f7a x12: 0000000034155555\\n[ 67.330574] x11: 0000000000000001 x10: 0000000000000001\\n[ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000\\n[ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a\\n[ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001\\n[ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8\\n[ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970\\n[ 67.330609] Call trace:\\n[ 67.330616] mempool_free+0x70/0xa0\\n[ 67.330627] bio_put+0xf8/0x110\\n[ 67.330638] dec_pending+0x13c/0x230\\n[ 67.330644] clone_endio+0x90/0x180\\n[ 67.330649] bio_endio+0x198/0x1b8\\n[ 67.330655] dec_pending+0x190/0x230\\n[ 67.330660] clone_endio+0x90/0x180\\n[ 67.330665] bio_endio+0x198/0x1b8\\n[ 67.330673] blk_update_request+0x214/0x428\\n[ 67.330683] scsi_end_request+0x2c/0x300\\n[ 67.330688] scsi_io_completion+0xa0/0x710\\n[ 67.330695] scsi_finish_command+0xd8/0x110\\n[ 67.330700] scsi_softirq_done+0x114/0x148\\n[ 67.330708] blk_done_softirq+0x74/0xd0\\n[ 67.330716] __do_softirq+0x18c/0x374\\n[ 67.330724] irq_exit+0xb4/0xb8\\n[ 67.330732] __handle_domain_irq+0x84/0xc0\\n[ 67.330737] gic_handle_irq+0x148/0x1b0\\n[ 67.330744] el1_irq+0xe8/0x190\\n[ 67.330753] lpm_cpuidle_enter+0x4f8/0x538\\n[ 67.330759] cpuidle_enter_state+0x1fc/0x398\\n[ 67.330764] cpuidle_enter+0x18/0x20\\n[ 67.330772] do_idle+0x1b4/0x290\\n[ 67.330778] cpu_startup_entry+0x20/0x28\\n[ 67.330786] secondary_start_kernel+0x160/0x170\\n\\nFix this by:\\n1) Establishing pointers to \u0027struct dm_io\u0027 members in\\ndm_io_dec_pending() so that they may be passed into end_io_acct()\\n_after_ free_io() is called.\\n2) Moving end_io_acct() after free_io().\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: dm: corrige la ejecuci\\u00f3n del puntero NULL de mempool al completar IO dm_io_dec_pending() llama a end_io_acct() primero y luego dec md en vuelo conteo pendiente. Pero si una tarea intercambia la tabla DM al mismo tiempo, esto puede provocar un bloqueo debido a que mempool-\u0026gt;elementos son NULL: tarea1 tarea2 do_resume -\u0026gt;do_suspend -\u0026gt;dm_wait_for_completion bio_endio -\u0026gt;clone_endio -\u0026gt;dm_io_dec_pending -\u0026gt;end_io_acct -\u0026gt;wakeup task1 - \u0026gt;dm_swap_table -\u0026gt;__bind -\u0026gt;__bind_mempools -\u0026gt;bioset_exit -\u0026gt;mempool_exit -\u0026gt;free_io [67.330330] No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\\u00f3n virtual 00000000000000000 ...... [67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO ) [67.330510] pc: mempool_free+0x70/0xa0 [67.330515] lr: mempool_free+0x4c/0xa0 [67.330520] sp: ffffff8008013b20 [67.330524] x29: ffffff8008013b20 x28: 000000000000004 [ 67.330530] x27: fffffa8c2ff40a0 x26: 00000000ffff1cc8 [ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800 [ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800 [ 67.330547] x21: 00000000ffff1cc8 x20: 1304d80 [ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c [ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd [ 67.330563] 000000000093b41e x14: 0000000000000010 [ 67.330569] x13: 0000000000007f7a x12: 0000000034155555 [ 67.330574] x11: 00000000000000001 x10: 0000000000000001 [ 67.330579] x9 : 0000000000000000 x8: 0000000000000000 [67.330585] x7: 0000000000000000 x6: ffffff80148b5c1a [67.330590] x5: ffffff8008013ae0 x4: 000000001 [67.330596] x3: ffffff80080139c8 x2: ffffff801083bab8 [67.330601] x1: 0000000000000000 x0: ffffffdada34c970 [67.330609] Rastreo de llamadas: [67.330616] mempool_free+0x70/0xa0 [67.330627] 8/0x110 [67.330638] dec_pending+0x13c/0x230 [67.330644] clone_endio+0x90/0x180 [ 67.330649] bio_endio+0x198/0x1b8 [ 67.330655] dec_pending+0x190/0x230 [ 67.330660] clone_endio+0x90/0x180 [ 67.330665] bio_endio+0x198/0x1b8 [ 67.330673 ] blk_update_request+0x214/0x428 [ 67.330683] scsi_end_request+0x2c/0x300 [ 67.330688 ] scsi_io_completion+0xa0/0x710 [ 67.330695] scsi_finish_command+0xd8/0x110 [ 67.330700] scsi_softirq_done+0x114/0x148 [ 67.330708] blk_done_softirq+0x74/0xd0 [ 67.3307 16] __do_softirq+0x18c/0x374 [ 67.330724] irq_exit+0xb4/0xb8 [ 67.330732] __handle_domain_irq +0x84/0xc0 [ 67.330737] gic_handle_irq+0x148/0x1b0 [ 67.330744] el1_irq+0xe8/0x190 [ 67.330753] lpm_cpuidle_enter+0x4f8/0x538 [ 67.330759] +0x1fc/0x398 [ 67.330764] cpuidle_enter+0x18/0x20 [ 67.330772] do_idle+0x1b4 /0x290 [ 67.330778] cpu_startup_entry+0x20/0x28 [ 67.330786] second_start_kernel+0x160/0x170 Solucione este problema de la siguiente manera: 1) Estableciendo punteros a los miembros \u0027struct dm_io\u0027 en dm_io_dec_pending() para que puedan pasarse a end_io_acct() _despu\\u00e9s_ free_io() se llama. 2) Mover end_io_acct() despu\\u00e9s de free_io().\"}]",
"id": "CVE-2021-47435",
"lastModified": "2024-11-21T06:36:08.267",
"published": "2024-05-22T07:15:08.790",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/6e506f07c5b561d673dd0b0d8f7f420cc48024fb\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9e07272cca2ed76f7f6073f4444b1143828c8d87\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9fb7cd5c7fef0f1c982e3cd27745a0dec260eaed\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ad1393b92e5059218d055bfec8f4946d85ad04c4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d208b89401e073de986dc891037c5a668f5d5d95\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d29c78d3f9c5d2604548c1065bf1ec212728ea61\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d35aef9c60d310eff3eaddacce301efe877e2b7c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/6e506f07c5b561d673dd0b0d8f7f420cc48024fb\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9e07272cca2ed76f7f6073f4444b1143828c8d87\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9fb7cd5c7fef0f1c982e3cd27745a0dec260eaed\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ad1393b92e5059218d055bfec8f4946d85ad04c4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d208b89401e073de986dc891037c5a668f5d5d95\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d29c78d3f9c5d2604548c1065bf1ec212728ea61\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d35aef9c60d310eff3eaddacce301efe877e2b7c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Awaiting Analysis"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-47435\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-22T07:15:08.790\",\"lastModified\":\"2026-06-17T04:17:27.853\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm: fix mempool NULL pointer race when completing IO\\n\\ndm_io_dec_pending() calls end_io_acct() first and will then dec md\\nin-flight pending count. But if a task is swapping DM table at same\\ntime this can result in a crash due to mempool-\u003eelements being NULL:\\n\\ntask1 task2\\ndo_resume\\n -\u003edo_suspend\\n -\u003edm_wait_for_completion\\n bio_endio\\n\\t\\t\\t\\t -\u003eclone_endio\\n\\t\\t\\t\\t -\u003edm_io_dec_pending\\n\\t\\t\\t\\t -\u003eend_io_acct\\n\\t\\t\\t\\t -\u003ewakeup task1\\n -\u003edm_swap_table\\n -\u003e__bind\\n -\u003e__bind_mempools\\n -\u003ebioset_exit\\n -\u003emempool_exit\\n -\u003efree_io\\n\\n[ 67.330330] Unable to handle kernel NULL pointer dereference at\\nvirtual address 0000000000000000\\n......\\n[ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO)\\n[ 67.330510] pc : mempool_free+0x70/0xa0\\n[ 67.330515] lr : mempool_free+0x4c/0xa0\\n[ 67.330520] sp : ffffff8008013b20\\n[ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004\\n[ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8\\n[ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800\\n[ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800\\n[ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80\\n[ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c\\n[ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd\\n[ 67.330563] x15: 000000000093b41e x14: 0000000000000010\\n[ 67.330569] x13: 0000000000007f7a x12: 0000000034155555\\n[ 67.330574] x11: 0000000000000001 x10: 0000000000000001\\n[ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000\\n[ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a\\n[ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001\\n[ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8\\n[ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970\\n[ 67.330609] Call trace:\\n[ 67.330616] mempool_free+0x70/0xa0\\n[ 67.330627] bio_put+0xf8/0x110\\n[ 67.330638] dec_pending+0x13c/0x230\\n[ 67.330644] clone_endio+0x90/0x180\\n[ 67.330649] bio_endio+0x198/0x1b8\\n[ 67.330655] dec_pending+0x190/0x230\\n[ 67.330660] clone_endio+0x90/0x180\\n[ 67.330665] bio_endio+0x198/0x1b8\\n[ 67.330673] blk_update_request+0x214/0x428\\n[ 67.330683] scsi_end_request+0x2c/0x300\\n[ 67.330688] scsi_io_completion+0xa0/0x710\\n[ 67.330695] scsi_finish_command+0xd8/0x110\\n[ 67.330700] scsi_softirq_done+0x114/0x148\\n[ 67.330708] blk_done_softirq+0x74/0xd0\\n[ 67.330716] __do_softirq+0x18c/0x374\\n[ 67.330724] irq_exit+0xb4/0xb8\\n[ 67.330732] __handle_domain_irq+0x84/0xc0\\n[ 67.330737] gic_handle_irq+0x148/0x1b0\\n[ 67.330744] el1_irq+0xe8/0x190\\n[ 67.330753] lpm_cpuidle_enter+0x4f8/0x538\\n[ 67.330759] cpuidle_enter_state+0x1fc/0x398\\n[ 67.330764] cpuidle_enter+0x18/0x20\\n[ 67.330772] do_idle+0x1b4/0x290\\n[ 67.330778] cpu_startup_entry+0x20/0x28\\n[ 67.330786] secondary_start_kernel+0x160/0x170\\n\\nFix this by:\\n1) Establishing pointers to \u0027struct dm_io\u0027 members in\\ndm_io_dec_pending() so that they may be passed into end_io_acct()\\n_after_ free_io() is called.\\n2) Moving end_io_acct() after free_io().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: dm: corrige la ejecuci\u00f3n del puntero NULL de mempool al completar IO dm_io_dec_pending() llama a end_io_acct() primero y luego dec md en vuelo conteo pendiente. Pero si una tarea intercambia la tabla DM al mismo tiempo, esto puede provocar un bloqueo debido a que mempool-\u0026gt;elementos son NULL: tarea1 tarea2 do_resume -\u0026gt;do_suspend -\u0026gt;dm_wait_for_completion bio_endio -\u0026gt;clone_endio -\u0026gt;dm_io_dec_pending -\u0026gt;end_io_acct -\u0026gt;wakeup task1 - \u0026gt;dm_swap_table -\u0026gt;__bind -\u0026gt;__bind_mempools -\u0026gt;bioset_exit -\u0026gt;mempool_exit -\u0026gt;free_io [67.330330] No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\u00f3n virtual 00000000000000000 ...... [67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO ) [67.330510] pc: mempool_free+0x70/0xa0 [67.330515] lr: mempool_free+0x4c/0xa0 [67.330520] sp: ffffff8008013b20 [67.330524] x29: ffffff8008013b20 x28: 000000000000004 [ 67.330530] x27: fffffa8c2ff40a0 x26: 00000000ffff1cc8 [ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800 [ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800 [ 67.330547] x21: 00000000ffff1cc8 x20: 1304d80 [ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c [ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd [ 67.330563] 000000000093b41e x14: 0000000000000010 [ 67.330569] x13: 0000000000007f7a x12: 0000000034155555 [ 67.330574] x11: 00000000000000001 x10: 0000000000000001 [ 67.330579] x9 : 0000000000000000 x8: 0000000000000000 [67.330585] x7: 0000000000000000 x6: ffffff80148b5c1a [67.330590] x5: ffffff8008013ae0 x4: 000000001 [67.330596] x3: ffffff80080139c8 x2: ffffff801083bab8 [67.330601] x1: 0000000000000000 x0: ffffffdada34c970 [67.330609] Rastreo de llamadas: [67.330616] mempool_free+0x70/0xa0 [67.330627] 8/0x110 [67.330638] dec_pending+0x13c/0x230 [67.330644] clone_endio+0x90/0x180 [ 67.330649] bio_endio+0x198/0x1b8 [ 67.330655] dec_pending+0x190/0x230 [ 67.330660] clone_endio+0x90/0x180 [ 67.330665] bio_endio+0x198/0x1b8 [ 67.330673 ] blk_update_request+0x214/0x428 [ 67.330683] scsi_end_request+0x2c/0x300 [ 67.330688 ] scsi_io_completion+0xa0/0x710 [ 67.330695] scsi_finish_command+0xd8/0x110 [ 67.330700] scsi_softirq_done+0x114/0x148 [ 67.330708] blk_done_softirq+0x74/0xd0 [ 67.3307 16] __do_softirq+0x18c/0x374 [ 67.330724] irq_exit+0xb4/0xb8 [ 67.330732] __handle_domain_irq +0x84/0xc0 [ 67.330737] gic_handle_irq+0x148/0x1b0 [ 67.330744] el1_irq+0xe8/0x190 [ 67.330753] lpm_cpuidle_enter+0x4f8/0x538 [ 67.330759] +0x1fc/0x398 [ 67.330764] cpuidle_enter+0x18/0x20 [ 67.330772] do_idle+0x1b4 /0x290 [ 67.330778] cpu_startup_entry+0x20/0x28 [ 67.330786] second_start_kernel+0x160/0x170 Solucione este problema de la siguiente manera: 1) Estableciendo punteros a los miembros \u0027struct dm_io\u0027 en dm_io_dec_pending() para que puedan pasarse a end_io_acct() _despu\u00e9s_ free_io() se llama. 2) Mover end_io_acct() despu\u00e9s de free_io().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/dm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\",\"lessThan\":\"9fb7cd5c7fef0f1c982e3cd27745a0dec260eaed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\",\"lessThan\":\"d35aef9c60d310eff3eaddacce301efe877e2b7c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\",\"lessThan\":\"9e07272cca2ed76f7f6073f4444b1143828c8d87\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\",\"lessThan\":\"ad1393b92e5059218d055bfec8f4946d85ad04c4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\",\"lessThan\":\"d29c78d3f9c5d2604548c1065bf1ec212728ea61\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\",\"lessThan\":\"6e506f07c5b561d673dd0b0d8f7f420cc48024fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\",\"lessThan\":\"d208b89401e073de986dc891037c5a668f5d5d95\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/dm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.37\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.37\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.313\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.278\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.242\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.193\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.113\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.14.14\",\"lessThanOrEqual\":\"5.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-22T18:48:43.435062Z\",\"id\":\"CVE-2021-47435\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.9.313\",\"matchCriteriaId\":\"D05FC8CB-1BC0-4990-907F-B25DF43CF175\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.278\",\"matchCriteriaId\":\"050329AA-B7D6-45EA-9341-E396DC054423\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.242\",\"matchCriteriaId\":\"7944E95B-9E17-4934-9745-B1FC58DD3A84\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.193\",\"matchCriteriaId\":\"EA77E853-1F30-4942-8B6A-37B168460310\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.113\",\"matchCriteriaId\":\"3AE702C9-4FF9-4ADB-A885-74A6BAB430C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.14.14\",\"matchCriteriaId\":\"BF43A331-D430-4B9D-A612-E63C62AE4A86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E46C74C6-B76B-4C94-A6A4-FD2FFF62D644\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"60134C3A-06E4-48C1-B04F-2903732A4E56\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"0460DA88-8FE1-46A2-9DDA-1F1ABA552E71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF55383D-4DF2-45DC-93F7-571F4F978EAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E9481B2-8AA6-4CBD-B5D3-C10F51FF6D01\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6e506f07c5b561d673dd0b0d8f7f420cc48024fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9e07272cca2ed76f7f6073f4444b1143828c8d87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9fb7cd5c7fef0f1c982e3cd27745a0dec260eaed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad1393b92e5059218d055bfec8f4946d85ad04c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d208b89401e073de986dc891037c5a668f5d5d95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d29c78d3f9c5d2604548c1065bf1ec212728ea61\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d35aef9c60d310eff3eaddacce301efe877e2b7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6e506f07c5b561d673dd0b0d8f7f420cc48024fb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9e07272cca2ed76f7f6073f4444b1143828c8d87\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9fb7cd5c7fef0f1c982e3cd27745a0dec260eaed\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad1393b92e5059218d055bfec8f4946d85ad04c4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d208b89401e073de986dc891037c5a668f5d5d95\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d29c78d3f9c5d2604548c1065bf1ec212728ea61\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d35aef9c60d310eff3eaddacce301efe877e2b7c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-06-28T06:26:24+00:00",
"cve": "CVE-2021-47435",
"id": "CVE-2021-47435",
"initial_release_date": "2021-01-01T00:00:00+00:00",
"product_status:fixed": "390",
"product_status:known_affected": "42",
"product_status:known_not_affected": "108",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: dm: fix mempool NULL pointer race when completing IO",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47435.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-12T17:15:38Z",
"cve": "CVE-2021-47435",
"id": "CVE-2021-47435",
"initial_release_date": "2024-05-25T03:34:21Z",
"product_status:known_affected": "344",
"product_status:known_not_affected": "130",
"product_status:recommended": "633",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2021-47435",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47435.json",
"version": "61"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9fb7cd5c7fef0f1c982e3cd27745a0dec260eaed\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d35aef9c60d310eff3eaddacce301efe877e2b7c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9e07272cca2ed76f7f6073f4444b1143828c8d87\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ad1393b92e5059218d055bfec8f4946d85ad04c4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d29c78d3f9c5d2604548c1065bf1ec212728ea61\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6e506f07c5b561d673dd0b0d8f7f420cc48024fb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d208b89401e073de986dc891037c5a668f5d5d95\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.225Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47435\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-22T18:48:43.435062Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-22T18:48:58.118Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"dm: fix mempool NULL pointer race when completing IO\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\", \"lessThan\": \"9fb7cd5c7fef0f1c982e3cd27745a0dec260eaed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\", \"lessThan\": \"d35aef9c60d310eff3eaddacce301efe877e2b7c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\", \"lessThan\": \"9e07272cca2ed76f7f6073f4444b1143828c8d87\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\", \"lessThan\": \"ad1393b92e5059218d055bfec8f4946d85ad04c4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\", \"lessThan\": \"d29c78d3f9c5d2604548c1065bf1ec212728ea61\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\", \"lessThan\": \"6e506f07c5b561d673dd0b0d8f7f420cc48024fb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a8736d10cb413be95ea443ba40f25c93f4ef9b2\", \"lessThan\": \"d208b89401e073de986dc891037c5a668f5d5d95\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/md/dm.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.37\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.37\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.9.313\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.278\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.242\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.193\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/md/dm.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9fb7cd5c7fef0f1c982e3cd27745a0dec260eaed\"}, {\"url\": \"https://git.kernel.org/stable/c/d35aef9c60d310eff3eaddacce301efe877e2b7c\"}, {\"url\": \"https://git.kernel.org/stable/c/9e07272cca2ed76f7f6073f4444b1143828c8d87\"}, {\"url\": \"https://git.kernel.org/stable/c/ad1393b92e5059218d055bfec8f4946d85ad04c4\"}, {\"url\": \"https://git.kernel.org/stable/c/d29c78d3f9c5d2604548c1065bf1ec212728ea61\"}, {\"url\": \"https://git.kernel.org/stable/c/6e506f07c5b561d673dd0b0d8f7f420cc48024fb\"}, {\"url\": \"https://git.kernel.org/stable/c/d208b89401e073de986dc891037c5a668f5d5d95\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm: fix mempool NULL pointer race when completing IO\\n\\ndm_io_dec_pending() calls end_io_acct() first and will then dec md\\nin-flight pending count. But if a task is swapping DM table at same\\ntime this can result in a crash due to mempool-\u003eelements being NULL:\\n\\ntask1 task2\\ndo_resume\\n -\u003edo_suspend\\n -\u003edm_wait_for_completion\\n bio_endio\\n\\t\\t\\t\\t -\u003eclone_endio\\n\\t\\t\\t\\t -\u003edm_io_dec_pending\\n\\t\\t\\t\\t -\u003eend_io_acct\\n\\t\\t\\t\\t -\u003ewakeup task1\\n -\u003edm_swap_table\\n -\u003e__bind\\n -\u003e__bind_mempools\\n -\u003ebioset_exit\\n -\u003emempool_exit\\n -\u003efree_io\\n\\n[ 67.330330] Unable to handle kernel NULL pointer dereference at\\nvirtual address 0000000000000000\\n......\\n[ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO)\\n[ 67.330510] pc : mempool_free+0x70/0xa0\\n[ 67.330515] lr : mempool_free+0x4c/0xa0\\n[ 67.330520] sp : ffffff8008013b20\\n[ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004\\n[ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8\\n[ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800\\n[ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800\\n[ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80\\n[ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c\\n[ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd\\n[ 67.330563] x15: 000000000093b41e x14: 0000000000000010\\n[ 67.330569] x13: 0000000000007f7a x12: 0000000034155555\\n[ 67.330574] x11: 0000000000000001 x10: 0000000000000001\\n[ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000\\n[ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a\\n[ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001\\n[ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8\\n[ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970\\n[ 67.330609] Call trace:\\n[ 67.330616] mempool_free+0x70/0xa0\\n[ 67.330627] bio_put+0xf8/0x110\\n[ 67.330638] dec_pending+0x13c/0x230\\n[ 67.330644] clone_endio+0x90/0x180\\n[ 67.330649] bio_endio+0x198/0x1b8\\n[ 67.330655] dec_pending+0x190/0x230\\n[ 67.330660] clone_endio+0x90/0x180\\n[ 67.330665] bio_endio+0x198/0x1b8\\n[ 67.330673] blk_update_request+0x214/0x428\\n[ 67.330683] scsi_end_request+0x2c/0x300\\n[ 67.330688] scsi_io_completion+0xa0/0x710\\n[ 67.330695] scsi_finish_command+0xd8/0x110\\n[ 67.330700] scsi_softirq_done+0x114/0x148\\n[ 67.330708] blk_done_softirq+0x74/0xd0\\n[ 67.330716] __do_softirq+0x18c/0x374\\n[ 67.330724] irq_exit+0xb4/0xb8\\n[ 67.330732] __handle_domain_irq+0x84/0xc0\\n[ 67.330737] gic_handle_irq+0x148/0x1b0\\n[ 67.330744] el1_irq+0xe8/0x190\\n[ 67.330753] lpm_cpuidle_enter+0x4f8/0x538\\n[ 67.330759] cpuidle_enter_state+0x1fc/0x398\\n[ 67.330764] cpuidle_enter+0x18/0x20\\n[ 67.330772] do_idle+0x1b4/0x290\\n[ 67.330778] cpu_startup_entry+0x20/0x28\\n[ 67.330786] secondary_start_kernel+0x160/0x170\\n\\nFix this by:\\n1) Establishing pointers to \u0027struct dm_io\u0027 members in\\ndm_io_dec_pending() so that they may be passed into end_io_acct()\\n_after_ free_io() is called.\\n2) Moving end_io_acct() after free_io().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.313\", \"versionStartIncluding\": \"2.6.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.278\", \"versionStartIncluding\": \"2.6.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.242\", \"versionStartIncluding\": \"2.6.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.193\", \"versionStartIncluding\": \"2.6.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.113\", \"versionStartIncluding\": \"2.6.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14.14\", \"versionStartIncluding\": \"2.6.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15\", \"versionStartIncluding\": \"2.6.37\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-21T08:31:48.566Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2021-47435\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-21T08:31:48.566Z\", \"dateReserved\": \"2024-05-21T14:58:30.830Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-22T06:19:31.562Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…