CVE-2021-47089
Vulnerability from cvelistv5
Published
2024-03-04 18:10
Modified
2024-11-04 11:59
Severity ?
3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Summary
kfence: fix memory leak when cat kfence objects
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0129ab1f268b6cf88825eae819b9b84aa0a85634
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2f06c8293d27f6337f907042c602c9c953988c48
Impacted products
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "2f06c8293d27",
                "status": "affected",
                "version": "0ce20dd84089",
                "versionType": "custom"
              },
              {
                "lessThan": "0129ab1f268b",
                "status": "affected",
                "version": "0ce20dd84089",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "5.12"
              },
              {
                "lessThan": "5.12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.15*",
                "status": "affected",
                "version": "5.15.12",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "*",
                "status": "affected",
                "version": "5.16",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 3.3,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47089",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-31T13:23:25.318113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-31T13:28:13.519Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.939Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2f06c8293d27f6337f907042c602c9c953988c48"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0129ab1f268b6cf88825eae819b9b84aa0a85634"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/kfence/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2f06c8293d27",
              "status": "affected",
              "version": "0ce20dd84089",
              "versionType": "git"
            },
            {
              "lessThan": "0129ab1f268b",
              "status": "affected",
              "version": "0ce20dd84089",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/kfence/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkfence: fix memory leak when cat kfence objects\n\nHulk robot reported a kmemleak problem:\n\n    unreferenced object 0xffff93d1d8cc02e8 (size 248):\n      comm \"cat\", pid 23327, jiffies 4624670141 (age 495992.217s)\n      hex dump (first 32 bytes):\n        00 40 85 19 d4 93 ff ff 00 10 00 00 00 00 00 00  .@..............\n        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n      backtrace:\n         seq_open+0x2a/0x80\n         full_proxy_open+0x167/0x1e0\n         do_dentry_open+0x1e1/0x3a0\n         path_openat+0x961/0xa20\n         do_filp_open+0xae/0x120\n         do_sys_openat2+0x216/0x2f0\n         do_sys_open+0x57/0x80\n         do_syscall_64+0x33/0x40\n         entry_SYSCALL_64_after_hwframe+0x44/0xa9\n    unreferenced object 0xffff93d419854000 (size 4096):\n      comm \"cat\", pid 23327, jiffies 4624670141 (age 495992.217s)\n      hex dump (first 32 bytes):\n        6b 66 65 6e 63 65 2d 23 32 35 30 3a 20 30 78 30  kfence-#250: 0x0\n        30 30 30 30 30 30 30 37 35 34 62 64 61 31 32 2d  0000000754bda12-\n      backtrace:\n         seq_read_iter+0x313/0x440\n         seq_read+0x14b/0x1a0\n         full_proxy_read+0x56/0x80\n         vfs_read+0xa5/0x1b0\n         ksys_read+0xa0/0xf0\n         do_syscall_64+0x33/0x40\n         entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nI find that we can easily reproduce this problem with the following\ncommands:\n\n\tcat /sys/kernel/debug/kfence/objects\n\techo scan \u003e /sys/kernel/debug/kmemleak\n\tcat /sys/kernel/debug/kmemleak\n\nThe leaked memory is allocated in the stack below:\n\n    do_syscall_64\n      do_sys_open\n        do_dentry_open\n          full_proxy_open\n            seq_open            ---\u003e alloc seq_file\n      vfs_read\n        full_proxy_read\n          seq_read\n            seq_read_iter\n              traverse          ---\u003e alloc seq_buf\n\nAnd it should have been released in the following process:\n\n    do_syscall_64\n      syscall_exit_to_user_mode\n        exit_to_user_mode_prepare\n          task_work_run\n            ____fput\n              __fput\n                full_proxy_release  ---\u003e free here\n\nHowever, the release function corresponding to file_operations is not\nimplemented in kfence.  As a result, a memory leak occurs.  Therefore,\nthe solution to this problem is to implement the corresponding release\nfunction."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-04T11:59:11.539Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2f06c8293d27f6337f907042c602c9c953988c48"
        },
        {
          "url": "https://git.kernel.org/stable/c/0129ab1f268b6cf88825eae819b9b84aa0a85634"
        }
      ],
      "title": "kfence: fix memory leak when cat kfence objects",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47089",
    "datePublished": "2024-03-04T18:10:27.495Z",
    "dateReserved": "2024-02-29T22:33:44.300Z",
    "dateUpdated": "2024-11-04T11:59:11.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47089\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-04T18:15:07.560\",\"lastModified\":\"2024-10-31T14:35:02.470\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nkfence: fix memory leak when cat kfence objects\\n\\nHulk robot reported a kmemleak problem:\\n\\n    unreferenced object 0xffff93d1d8cc02e8 (size 248):\\n      comm \\\"cat\\\", pid 23327, jiffies 4624670141 (age 495992.217s)\\n      hex dump (first 32 bytes):\\n        00 40 85 19 d4 93 ff ff 00 10 00 00 00 00 00 00  .@..............\\n        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\\n      backtrace:\\n         seq_open+0x2a/0x80\\n         full_proxy_open+0x167/0x1e0\\n         do_dentry_open+0x1e1/0x3a0\\n         path_openat+0x961/0xa20\\n         do_filp_open+0xae/0x120\\n         do_sys_openat2+0x216/0x2f0\\n         do_sys_open+0x57/0x80\\n         do_syscall_64+0x33/0x40\\n         entry_SYSCALL_64_after_hwframe+0x44/0xa9\\n    unreferenced object 0xffff93d419854000 (size 4096):\\n      comm \\\"cat\\\", pid 23327, jiffies 4624670141 (age 495992.217s)\\n      hex dump (first 32 bytes):\\n        6b 66 65 6e 63 65 2d 23 32 35 30 3a 20 30 78 30  kfence-#250: 0x0\\n        30 30 30 30 30 30 30 37 35 34 62 64 61 31 32 2d  0000000754bda12-\\n      backtrace:\\n         seq_read_iter+0x313/0x440\\n         seq_read+0x14b/0x1a0\\n         full_proxy_read+0x56/0x80\\n         vfs_read+0xa5/0x1b0\\n         ksys_read+0xa0/0xf0\\n         do_syscall_64+0x33/0x40\\n         entry_SYSCALL_64_after_hwframe+0x44/0xa9\\n\\nI find that we can easily reproduce this problem with the following\\ncommands:\\n\\n\\tcat /sys/kernel/debug/kfence/objects\\n\\techo scan \u003e /sys/kernel/debug/kmemleak\\n\\tcat /sys/kernel/debug/kmemleak\\n\\nThe leaked memory is allocated in the stack below:\\n\\n    do_syscall_64\\n      do_sys_open\\n        do_dentry_open\\n          full_proxy_open\\n            seq_open            ---\u003e alloc seq_file\\n      vfs_read\\n        full_proxy_read\\n          seq_read\\n            seq_read_iter\\n              traverse          ---\u003e alloc seq_buf\\n\\nAnd it should have been released in the following process:\\n\\n    do_syscall_64\\n      syscall_exit_to_user_mode\\n        exit_to_user_mode_prepare\\n          task_work_run\\n            ____fput\\n              __fput\\n                full_proxy_release  ---\u003e free here\\n\\nHowever, the release function corresponding to file_operations is not\\nimplemented in kfence.  As a result, a memory leak occurs.  Therefore,\\nthe solution to this problem is to implement the corresponding release\\nfunction.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: kfence: repara la p\u00e9rdida de memoria cuando los objetos cat kfence Hulk robot inform\u00f3 un problema kmemleak: objeto sin referencia 0xffff93d1d8cc02e8 (tama\u00f1o 248): comm \\\"cat\\\", pid 23327, jiffies 4624670141 (edad 495992.217s ) volcado hexadecimal (primeros 32 bytes): 00 40 85 19 d4 93 ff ff 00 10 00 00 00 00 00 00 .@.............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................. rastreo inverso: seq_open+0x2a/0x80 full_proxy_open+0x167/0x1e0 do_dentry_open+0x1e1/0x3a0 path_openat+0x961/0xa20 do_filp_open+0xae/0x120 do_sys_openat2+0x216/0x2f0 do_sys_open+0x57/0x80 do_syscall_64+0x33/0x40 Entry_SYSCALL_64_after_hwframe+0x44/0xa9 objeto sin referencia 0xffff93d419854000 (tama\u00f1o 4096): comm \\\"cat\\\", pid 23327, Jiffies 4624670141 (edad 495992,217 s) volcado hexadecimal (primeros 32 bytes) : 6b 66 65 6e 63 65 2d 23 32 35 30 3a 20 30 78 30 kfence-#250: 0x0 30 30 30 30 30 30 30 37 35 34 62 64 61 31 32 2d 0000000754bda1 2- rastreo inverso: seq_read_iter+0x313/0x440 seq_read+ 0x14b/0x1a0 full_proxy_read+0x56/0x80 vfs_read+0xa5/0x1b0 ksys_read+0xa0/0xf0 do_syscall_64+0x33/0x40 Entry_SYSCALL_64_after_hwframe+0x44/0xa9 Creo que podemos reproducir f\u00e1cilmente este problema con los siguientes comandos: cat /sys/kernel/ depurar/ kfence/objects echo scan \u0026gt; /sys/kernel/debug/kmemleak cat /sys/kernel/debug/kmemleak La memoria filtrada se asigna en la pila siguiente: do_syscall_64 do_sys_open do_dentry_open full_proxy_open seq_open ---\u0026gt; alloc seq_file vfs_read full_proxy_read seq_read seq_read_iter traverse - --\u0026gt; alloc seq_buf Y deber\u00eda haberse liberado en el siguiente proceso: do_syscall_64 syscall_exit_to_user_mode exit_to_user_mode_prepare task_work_run ____fput __fput full_proxy_release ---\u0026gt; free aqu\u00ed Sin embargo, la funci\u00f3n de liberaci\u00f3n correspondiente a file_operatives no est\u00e1 implementada en kfence. Como resultado, se produce una p\u00e9rdida de memoria. Por tanto, la soluci\u00f3n a este problema es implementar la funci\u00f3n de liberaci\u00f3n correspondiente.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0129ab1f268b6cf88825eae819b9b84aa0a85634\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2f06c8293d27f6337f907042c602c9c953988c48\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.