CVE-2021-46993 (GCVE-0-2021-46993)

Vulnerability from cvelistv5 – Published: 2024-02-28 08:13 – Updated: 2026-08-05 08:45
VLAI
Title
sched: Fix out-of-bound access in uclamp
Summary
In the Linux kernel, the following vulnerability has been resolved: sched: Fix out-of-bound access in uclamp Util-clamp places tasks in different buckets based on their clamp values for performance reasons. However, the size of buckets is currently computed using a rounding division, which can lead to an off-by-one error in some configurations. For instance, with 20 buckets, the bucket size will be 1024/20=51. A task with a clamp of 1024 will be mapped to bucket id 1024/51=20. Sadly, correct indexes are in range [0,19], hence leading to an out of bound memory access. Clamp the bucket id to fix the issue.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:01 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 69842cba9ace84849bb9b8edcdf2cefccd97901c , < 687f523c134b7f0bd040ee1230f6d17990d54172 (git)
Affected: 69842cba9ace84849bb9b8edcdf2cefccd97901c , < f7347c85490b92dd144fa1fba9e1eca501656ab3 (git)
Affected: 69842cba9ace84849bb9b8edcdf2cefccd97901c , < 3da3f804b82a0a382d523a21acf4cf3bb35f936d (git)
Affected: 69842cba9ace84849bb9b8edcdf2cefccd97901c , < 42ee47c7e3569d9a0e2cb5053c496d97d380472f (git)
Affected: 69842cba9ace84849bb9b8edcdf2cefccd97901c , < 6d2f8909a5fabb73fe2a63918117943986c39b6c (git)
Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.4.120 , ≤ 5.4.* (semver)
Unaffected: 5.10.38 , ≤ 5.10.* (semver)
Unaffected: 5.11.22 , ≤ 5.11.* (semver)
Unaffected: 5.12.5 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:37.912Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/687f523c134b7f0bd040ee1230f6d17990d54172"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f7347c85490b92dd144fa1fba9e1eca501656ab3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3da3f804b82a0a382d523a21acf4cf3bb35f936d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/42ee47c7e3569d9a0e2cb5053c496d97d380472f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6d2f8909a5fabb73fe2a63918117943986c39b6c"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-46993",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:01:01.662746Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:38.812Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "687f523c134b7f0bd040ee1230f6d17990d54172",
              "status": "affected",
              "version": "69842cba9ace84849bb9b8edcdf2cefccd97901c",
              "versionType": "git"
            },
            {
              "lessThan": "f7347c85490b92dd144fa1fba9e1eca501656ab3",
              "status": "affected",
              "version": "69842cba9ace84849bb9b8edcdf2cefccd97901c",
              "versionType": "git"
            },
            {
              "lessThan": "3da3f804b82a0a382d523a21acf4cf3bb35f936d",
              "status": "affected",
              "version": "69842cba9ace84849bb9b8edcdf2cefccd97901c",
              "versionType": "git"
            },
            {
              "lessThan": "42ee47c7e3569d9a0e2cb5053c496d97d380472f",
              "status": "affected",
              "version": "69842cba9ace84849bb9b8edcdf2cefccd97901c",
              "versionType": "git"
            },
            {
              "lessThan": "6d2f8909a5fabb73fe2a63918117943986c39b6c",
              "status": "affected",
              "version": "69842cba9ace84849bb9b8edcdf2cefccd97901c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.120",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.38",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.22",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.5",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched: Fix out-of-bound access in uclamp\n\nUtil-clamp places tasks in different buckets based on their clamp values\nfor performance reasons. However, the size of buckets is currently\ncomputed using a rounding division, which can lead to an off-by-one\nerror in some configurations.\n\nFor instance, with 20 buckets, the bucket size will be 1024/20=51. A\ntask with a clamp of 1024 will be mapped to bucket id 1024/51=20. Sadly,\ncorrect indexes are in range [0,19], hence leading to an out of bound\nmemory access.\n\nClamp the bucket id to fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via the local sched_setattr syscall when a task sets util-clamp attributes; it is not reachable from the network stack or remote protocol handlers.\nAC:L - On the primary uclamp deployment (Android GKI with UCLAMP_BUCKETS_COUNT=20), setting clamp value 1024 reliably maps to out-of-range bucket_id 20 with no race or attacker-uncontrollable condition.\nPR:L - An unprivileged process can set its own sched_util_min/max through sched_setattr; __sched_setscheduler does not require CAP_SYS_NICE for UTIL_CLAMP on a same-owner fair-policy task.\nUI:N - Exploitation requires only the attacker\u2019s own syscalls; no victim action such as opening a file or mounting a filesystem is needed.\nS:U - The corruption stays within the host kernel\u2019s scheduling authority and does not cross a VM, IOMMU, or other security boundary.\nC:H - The out-of-bounds bucket access reads and writes adjacent per-CPU runqueue memory (including into cfs_rq), which can be leveraged for kernel information disclosure under the memory-corruption guidance.\nI:H - uclamp_rq_inc_id/dec_id perform out-of-bounds writes (tasks++/value assignment) that, for UCLAMP_MAX, land on uclamp_flags and the start of cfs_rq, enabling scheduler-state corruption and control-flow impact.\nA:H - Corrupting runqueue uclamp/cfs state can cause kernel warnings, oopses, or hangs, as seen when the bug was found via SCHED_WARN_ON on Android."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:45:26.827Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/687f523c134b7f0bd040ee1230f6d17990d54172"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7347c85490b92dd144fa1fba9e1eca501656ab3"
        },
        {
          "url": "https://git.kernel.org/stable/c/3da3f804b82a0a382d523a21acf4cf3bb35f936d"
        },
        {
          "url": "https://git.kernel.org/stable/c/42ee47c7e3569d9a0e2cb5053c496d97d380472f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d2f8909a5fabb73fe2a63918117943986c39b6c"
        }
      ],
      "title": "sched: Fix out-of-bound access in uclamp",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-46993",
    "datePublished": "2024-02-28T08:13:18.494Z",
    "dateReserved": "2024-02-27T18:42:55.949Z",
    "dateUpdated": "2026-08-05T08:45:26.827Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-46993",
      "date": "2026-08-15",
      "epss": "0.00241",
      "percentile": "0.15539"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.3\", \"versionEndExcluding\": \"5.4.120\", \"matchCriteriaId\": \"E868B513-59E3-4DE6-AC7C-E0219F1AD2C8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.38\", \"matchCriteriaId\": \"2BB4E5E8-4AAD-475A-A1B9-F287254C7D72\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.11.22\", \"matchCriteriaId\": \"83B53E9A-F426-4C03-9A5F-A931FF79827E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.12\", \"versionEndExcluding\": \"5.12.5\", \"matchCriteriaId\": \"0274929A-B36C-4F4C-AB22-30A0DD6B995B\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched: Fix out-of-bound access in uclamp\\n\\nUtil-clamp places tasks in different buckets based on their clamp values\\nfor performance reasons. However, the size of buckets is currently\\ncomputed using a rounding division, which can lead to an off-by-one\\nerror in some configurations.\\n\\nFor instance, with 20 buckets, the bucket size will be 1024/20=51. A\\ntask with a clamp of 1024 will be mapped to bucket id 1024/51=20. Sadly,\\ncorrect indexes are in range [0,19], hence leading to an out of bound\\nmemory access.\\n\\nClamp the bucket id to fix the issue.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: sched: corrige el acceso fuera de los l\\u00edmites en uclamp Util-clamp coloca las tareas en diferentes dep\\u00f3sitos seg\\u00fan sus valores de fijaci\\u00f3n por razones de rendimiento. Sin embargo, el tama\\u00f1o de los dep\\u00f3sitos se calcula actualmente mediante una divisi\\u00f3n de redondeo, lo que puede provocar un error de uno por uno en algunas configuraciones. Por ejemplo, con 20 dep\\u00f3sitos, el tama\\u00f1o del dep\\u00f3sito ser\\u00e1 1024/20=51. Una tarea con una abrazadera de 1024 se asignar\\u00e1 al ID del dep\\u00f3sito 1024/51=20. Lamentablemente, los \\u00edndices correctos est\\u00e1n en el rango [0,19], lo que provoca un acceso a la memoria fuera de los l\\u00edmites. Sujete la identificaci\\u00f3n del dep\\u00f3sito para solucionar el problema.\"}]",
      "id": "CVE-2021-46993",
      "lastModified": "2024-12-24T14:40:13.420",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.2}]}",
      "published": "2024-02-28T09:15:37.880",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/3da3f804b82a0a382d523a21acf4cf3bb35f936d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/42ee47c7e3569d9a0e2cb5053c496d97d380472f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/687f523c134b7f0bd040ee1230f6d17990d54172\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6d2f8909a5fabb73fe2a63918117943986c39b6c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f7347c85490b92dd144fa1fba9e1eca501656ab3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3da3f804b82a0a382d523a21acf4cf3bb35f936d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/42ee47c7e3569d9a0e2cb5053c496d97d380472f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/687f523c134b7f0bd040ee1230f6d17990d54172\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6d2f8909a5fabb73fe2a63918117943986c39b6c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f7347c85490b92dd144fa1fba9e1eca501656ab3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-125\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-46993\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-02-28T09:15:37.880\",\"lastModified\":\"2026-08-04T10:16:40.427\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched: Fix out-of-bound access in uclamp\\n\\nUtil-clamp places tasks in different buckets based on their clamp values\\nfor performance reasons. However, the size of buckets is currently\\ncomputed using a rounding division, which can lead to an off-by-one\\nerror in some configurations.\\n\\nFor instance, with 20 buckets, the bucket size will be 1024/20=51. A\\ntask with a clamp of 1024 will be mapped to bucket id 1024/51=20. Sadly,\\ncorrect indexes are in range [0,19], hence leading to an out of bound\\nmemory access.\\n\\nClamp the bucket id to fix the issue.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: sched: corrige el acceso fuera de los l\u00edmites en uclamp Util-clamp coloca las tareas en diferentes dep\u00f3sitos seg\u00fan sus valores de fijaci\u00f3n por razones de rendimiento. Sin embargo, el tama\u00f1o de los dep\u00f3sitos se calcula actualmente mediante una divisi\u00f3n de redondeo, lo que puede provocar un error de uno por uno en algunas configuraciones. Por ejemplo, con 20 dep\u00f3sitos, el tama\u00f1o del dep\u00f3sito ser\u00e1 1024/20=51. Una tarea con una abrazadera de 1024 se asignar\u00e1 al ID del dep\u00f3sito 1024/51=20. Lamentablemente, los \u00edndices correctos est\u00e1n en el rango [0,19], lo que provoca un acceso a la memoria fuera de los l\u00edmites. Sujete la identificaci\u00f3n del dep\u00f3sito para solucionar el problema.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/sched/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"69842cba9ace84849bb9b8edcdf2cefccd97901c\",\"lessThan\":\"687f523c134b7f0bd040ee1230f6d17990d54172\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"69842cba9ace84849bb9b8edcdf2cefccd97901c\",\"lessThan\":\"f7347c85490b92dd144fa1fba9e1eca501656ab3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"69842cba9ace84849bb9b8edcdf2cefccd97901c\",\"lessThan\":\"3da3f804b82a0a382d523a21acf4cf3bb35f936d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"69842cba9ace84849bb9b8edcdf2cefccd97901c\",\"lessThan\":\"42ee47c7e3569d9a0e2cb5053c496d97d380472f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"69842cba9ace84849bb9b8edcdf2cefccd97901c\",\"lessThan\":\"6d2f8909a5fabb73fe2a63918117943986c39b6c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/sched/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.120\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.38\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.11.22\",\"lessThanOrEqual\":\"5.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.5\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:01:01.662746Z\",\"id\":\"CVE-2021-46993\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.3\",\"versionEndExcluding\":\"5.4.120\",\"matchCriteriaId\":\"E868B513-59E3-4DE6-AC7C-E0219F1AD2C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.38\",\"matchCriteriaId\":\"2BB4E5E8-4AAD-475A-A1B9-F287254C7D72\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.11.22\",\"matchCriteriaId\":\"83B53E9A-F426-4C03-9A5F-A931FF79827E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"5.12.5\",\"matchCriteriaId\":\"0274929A-B36C-4F4C-AB22-30A0DD6B995B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3da3f804b82a0a382d523a21acf4cf3bb35f936d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/42ee47c7e3569d9a0e2cb5053c496d97d380472f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/687f523c134b7f0bd040ee1230f6d17990d54172\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6d2f8909a5fabb73fe2a63918117943986c39b6c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f7347c85490b92dd144fa1fba9e1eca501656ab3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3da3f804b82a0a382d523a21acf4cf3bb35f936d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/42ee47c7e3569d9a0e2cb5053c496d97d380472f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/687f523c134b7f0bd040ee1230f6d17990d54172\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6d2f8909a5fabb73fe2a63918117943986c39b6c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f7347c85490b92dd144fa1fba9e1eca501656ab3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:09:56+00:00",
      "cve": "CVE-2021-46993",
      "id": "CVE-2021-46993",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sched: Fix out-of-bound access in uclamp",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-46993.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:24:10Z",
      "cve": "CVE-2021-46993",
      "id": "CVE-2021-46993",
      "initial_release_date": "2024-03-01T04:07:59Z",
      "product_status:known_not_affected": "292",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-46993",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-46993.json",
      "version": "17"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/687f523c134b7f0bd040ee1230f6d17990d54172\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f7347c85490b92dd144fa1fba9e1eca501656ab3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3da3f804b82a0a382d523a21acf4cf3bb35f936d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/42ee47c7e3569d9a0e2cb5053c496d97d380472f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6d2f8909a5fabb73fe2a63918117943986c39b6c\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:37.912Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-46993\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:01:01.662746Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:17.847Z\"}}], \"cna\": {\"title\": \"sched: Fix out-of-bound access in uclamp\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached via the local sched_setattr syscall when a task sets util-clamp attributes; it is not reachable from the network stack or remote protocol handlers.\\nAC:L - On the primary uclamp deployment (Android GKI with UCLAMP_BUCKETS_COUNT=20), setting clamp value 1024 reliably maps to out-of-range bucket_id 20 with no race or attacker-uncontrollable condition.\\nPR:L - An unprivileged process can set its own sched_util_min/max through sched_setattr; __sched_setscheduler does not require CAP_SYS_NICE for UTIL_CLAMP on a same-owner fair-policy task.\\nUI:N - Exploitation requires only the attacker\\u2019s own syscalls; no victim action such as opening a file or mounting a filesystem is needed.\\nS:U - The corruption stays within the host kernel\\u2019s scheduling authority and does not cross a VM, IOMMU, or other security boundary.\\nC:H - The out-of-bounds bucket access reads and writes adjacent per-CPU runqueue memory (including into cfs_rq), which can be leveraged for kernel information disclosure under the memory-corruption guidance.\\nI:H - uclamp_rq_inc_id/dec_id perform out-of-bounds writes (tasks++/value assignment) that, for UCLAMP_MAX, land on uclamp_flags and the start of cfs_rq, enabling scheduler-state corruption and control-flow impact.\\nA:H - Corrupting runqueue uclamp/cfs state can cause kernel warnings, oopses, or hangs, as seen when the bug was found via SCHED_WARN_ON on Android.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"69842cba9ace84849bb9b8edcdf2cefccd97901c\", \"lessThan\": \"687f523c134b7f0bd040ee1230f6d17990d54172\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"69842cba9ace84849bb9b8edcdf2cefccd97901c\", \"lessThan\": \"f7347c85490b92dd144fa1fba9e1eca501656ab3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"69842cba9ace84849bb9b8edcdf2cefccd97901c\", \"lessThan\": \"3da3f804b82a0a382d523a21acf4cf3bb35f936d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"69842cba9ace84849bb9b8edcdf2cefccd97901c\", \"lessThan\": \"42ee47c7e3569d9a0e2cb5053c496d97d380472f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"69842cba9ace84849bb9b8edcdf2cefccd97901c\", \"lessThan\": \"6d2f8909a5fabb73fe2a63918117943986c39b6c\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/sched/core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.38\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.11.22\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.11.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/sched/core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/687f523c134b7f0bd040ee1230f6d17990d54172\"}, {\"url\": \"https://git.kernel.org/stable/c/f7347c85490b92dd144fa1fba9e1eca501656ab3\"}, {\"url\": \"https://git.kernel.org/stable/c/3da3f804b82a0a382d523a21acf4cf3bb35f936d\"}, {\"url\": \"https://git.kernel.org/stable/c/42ee47c7e3569d9a0e2cb5053c496d97d380472f\"}, {\"url\": \"https://git.kernel.org/stable/c/6d2f8909a5fabb73fe2a63918117943986c39b6c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched: Fix out-of-bound access in uclamp\\n\\nUtil-clamp places tasks in different buckets based on their clamp values\\nfor performance reasons. However, the size of buckets is currently\\ncomputed using a rounding division, which can lead to an off-by-one\\nerror in some configurations.\\n\\nFor instance, with 20 buckets, the bucket size will be 1024/20=51. A\\ntask with a clamp of 1024 will be mapped to bucket id 1024/51=20. Sadly,\\ncorrect indexes are in range [0,19], hence leading to an out of bound\\nmemory access.\\n\\nClamp the bucket id to fix the issue.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.120\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.38\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.11.22\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.5\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"5.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:45:26.827Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-46993\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:45:26.827Z\", \"dateReserved\": \"2024-02-27T18:42:55.949Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-28T08:13:18.494Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.