fkie_cve-2021-47462
Vulnerability from fkie_nvd
Published
2024-05-22 07:15
Modified
2025-02-03 15:46
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: do not allow illegal MPOL_F_NUMA_BALANCING | MPOL_LOCAL in mbind() syzbot reported access to unitialized memory in mbind() [1] Issue came with commit bda420b98505 ("numa balancing: migrate on fault among multiple bound nodes") This commit added a new bit in MPOL_MODE_FLAGS, but only checked valid combination (MPOL_F_NUMA_BALANCING can only be used with MPOL_BIND) in do_set_mempolicy() This patch moves the check in sanitize_mpol_flags() so that it is also used by mbind() [1] BUG: KMSAN: uninit-value in __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h:105 [inline] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_alloc_node mm/slub.c:3221 [inline] slab_alloc mm/slub.c:3230 [inline] kmem_cache_alloc+0x751/0xff0 mm/slub.c:3235 mpol_new mm/mempolicy.c:293 [inline] do_mbind+0x912/0x15f0 mm/mempolicy.c:1289 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae ===================================================== Kernel panic - not syncing: panic_on_kmsan set ... CPU: 0 PID: 15049 Comm: syz-executor.0 Tainted: G B 5.15.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1ff/0x28e lib/dump_stack.c:106 dump_stack+0x25/0x28 lib/dump_stack.c:113 panic+0x44f/0xdeb kernel/panic.c:232 kmsan_report+0x2ee/0x300 mm/kmsan/report.c:186 __msan_warning+0xd7/0x150 mm/kmsan/instrumentation.c:208 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h:105 [inline] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6d2aec9e123bb9c49cb5c7fc654f25f81e688e8cPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9ee4e9ae98f1f262d6fae0d266cfdf3ba2c321d9Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/6d2aec9e123bb9c49cb5c7fc654f25f81e688e8cPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/9ee4e9ae98f1f262d6fae0d266cfdf3ba2c321d9Patch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel 5.15
linux linux_kernel 5.15
linux linux_kernel 5.15
linux linux_kernel 5.15
linux linux_kernel 5.15
linux linux_kernel 5.15


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "CFEAA14C-4860-49B1-9532-8AFC5E1BDEF5",
                     versionEndExcluding: "5.14.15",
                     versionStartIncluding: "5.12",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*",
                     matchCriteriaId: "E46C74C6-B76B-4C94-A6A4-FD2FFF62D644",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*",
                     matchCriteriaId: "60134C3A-06E4-48C1-B04F-2903732A4E56",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*",
                     matchCriteriaId: "0460DA88-8FE1-46A2-9DDA-1F1ABA552E71",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*",
                     matchCriteriaId: "AF55383D-4DF2-45DC-93F7-571F4F978EAB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*",
                     matchCriteriaId: "9E9481B2-8AA6-4CBD-B5D3-C10F51FF6D01",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*",
                     matchCriteriaId: "EBD45831-4B79-42BC-ABC0-86870F0DEA89",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempolicy: do not allow illegal MPOL_F_NUMA_BALANCING | MPOL_LOCAL in mbind()\n\nsyzbot reported access to unitialized memory in mbind() [1]\n\nIssue came with commit bda420b98505 (\"numa balancing: migrate on fault\namong multiple bound nodes\")\n\nThis commit added a new bit in MPOL_MODE_FLAGS, but only checked valid\ncombination (MPOL_F_NUMA_BALANCING can only be used with MPOL_BIND) in\ndo_set_mempolicy()\n\nThis patch moves the check in sanitize_mpol_flags() so that it is also\nused by mbind()\n\n  [1]\n  BUG: KMSAN: uninit-value in __mpol_equal+0x567/0x590 mm/mempolicy.c:2260\n   __mpol_equal+0x567/0x590 mm/mempolicy.c:2260\n   mpol_equal include/linux/mempolicy.h:105 [inline]\n   vma_merge+0x4a1/0x1e60 mm/mmap.c:1190\n   mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811\n   do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333\n   kernel_mbind mm/mempolicy.c:1483 [inline]\n   __do_sys_mbind mm/mempolicy.c:1490 [inline]\n   __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486\n   __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486\n   do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n   do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n  Uninit was created at:\n   slab_alloc_node mm/slub.c:3221 [inline]\n   slab_alloc mm/slub.c:3230 [inline]\n   kmem_cache_alloc+0x751/0xff0 mm/slub.c:3235\n   mpol_new mm/mempolicy.c:293 [inline]\n   do_mbind+0x912/0x15f0 mm/mempolicy.c:1289\n   kernel_mbind mm/mempolicy.c:1483 [inline]\n   __do_sys_mbind mm/mempolicy.c:1490 [inline]\n   __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486\n   __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486\n   do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n   do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n  =====================================================\n  Kernel panic - not syncing: panic_on_kmsan set ...\n  CPU: 0 PID: 15049 Comm: syz-executor.0 Tainted: G    B             5.15.0-rc2-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n  Call Trace:\n   __dump_stack lib/dump_stack.c:88 [inline]\n   dump_stack_lvl+0x1ff/0x28e lib/dump_stack.c:106\n   dump_stack+0x25/0x28 lib/dump_stack.c:113\n   panic+0x44f/0xdeb kernel/panic.c:232\n   kmsan_report+0x2ee/0x300 mm/kmsan/report.c:186\n   __msan_warning+0xd7/0x150 mm/kmsan/instrumentation.c:208\n   __mpol_equal+0x567/0x590 mm/mempolicy.c:2260\n   mpol_equal include/linux/mempolicy.h:105 [inline]\n   vma_merge+0x4a1/0x1e60 mm/mmap.c:1190\n   mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811\n   do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333\n   kernel_mbind mm/mempolicy.c:1483 [inline]\n   __do_sys_mbind mm/mempolicy.c:1490 [inline]\n   __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486\n   __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486\n   do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n   do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n   entry_SYSCALL_64_after_hwframe+0x44/0xae",
      },
      {
         lang: "es",
         value: "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: mm/mempolicy: no permitir MPOL_F_NUMA_BALANCING ilegal | MPOL_LOCAL en mbind() syzbot informó acceso a la memoria unificada en mbind() [1] El problema surgió con el commit bda420b98505 (\"equilibrio numa: migrar en caso de falla entre múltiples nodos vinculados\") Esta confirmación agregó un nuevo bit en MPOL_MODE_FLAGS, pero solo marcó que era válido combinación (MPOL_F_NUMA_BALANCING solo se puede usar con MPOL_BIND) en do_set_mempolicy() Este parche mueve la verificación en sanitize_mpol_flags() para que también sea usado por mbind() [1] ERROR: KMSAN: valor uninit en __mpol_equal+0x567/0x590 mm /mempolicy.c:2260 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h:105 [en línea] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/ mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [en línea] __do_sys_mbind mm/mempolicy.c:1490 [en línea] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c: 1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [en línea] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 Entry_SYSCALL_64_after_hwframe+0 Unidad x44/0xae fue creado en: slab_alloc_node mm/slub.c:3221 [en línea] slab_alloc mm/slub.c:3230 [en línea] kmem_cache_alloc+0x751/0xff0 mm/slub.c:3235 mpol_new mm/mempolicy.c:293 [en línea] do_mbind +0x912/0x15f0 mm/mempolicy.c:1289 kernel_mbind mm/mempolicy.c:1483 [en línea] __do_sys_mbind mm/mempolicy.c:1490 [en línea] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0 x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [en línea] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 Entry_SYSCALL_64_after_hwframe+0x44/0xae ======= =============================================== Pánico del kernel - no sincronización: pánico_on_kmsan set... CPU: 0 PID: 15049 Comm: syz-executor.0 Contaminado: GB 5.15.0-rc2-syzkaller #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/ Seguimiento de llamadas de 2011: __dump_stack lib/dump_stack.c:88 [en línea] dump_stack_lvl+0x1ff/0x28e lib/dump_stack.c:106 dump_stack+0x25/0x28 lib/dump_stack.c:113 pánico+0x44f/0xdeb kernel/panic.c: 232 kmsan_report+0x2ee/0x300 mm/kmsan/report.c:186 __msan_warning+0xd7/0x150 mm/kmsan/instrumentation.c:208 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h: 105 [en línea] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [en línea ] __do_sys_mbind mm/mempolicy.c:1490 [en línea] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common. c:51 [en línea ] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 Entry_SYSCALL_64_after_hwframe+0x44/0xae",
      },
   ],
   id: "CVE-2021-47462",
   lastModified: "2025-02-03T15:46:30.700",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-05-22T07:15:11.117",
   references: [
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/6d2aec9e123bb9c49cb5c7fc654f25f81e688e8c",
      },
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/9ee4e9ae98f1f262d6fae0d266cfdf3ba2c321d9",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/6d2aec9e123bb9c49cb5c7fc654f25f81e688e8c",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/9ee4e9ae98f1f262d6fae0d266cfdf3ba2c321d9",
      },
   ],
   sourceIdentifier: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-908",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.