GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47375 (GCVE-0-2021-47375)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:03 – Updated: 2026-05-11 13:53
VLAI
Title
blktrace: Fix uaf in blk_trace access after removing by sysfs
Summary
In the Linux kernel, the following vulnerability has been resolved: blktrace: Fix uaf in blk_trace access after removing by sysfs There is an use-after-free problem triggered by following process: P1(sda) P2(sdb) echo 0 > /sys/block/sdb/trace/enable blk_trace_remove_queue synchronize_rcu blk_trace_free relay_close rcu_read_lock __blk_add_trace trace_note_tsk (Iterate running_trace_list) relay_close_buf relay_destroy_buf kfree(buf) trace_note(sdb's bt) relay_reserve buf->offset <- nullptr deference (use-after-free) !!! rcu_read_unlock [ 502.714379] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 502.715260] #PF: supervisor read access in kernel mode [ 502.715903] #PF: error_code(0x0000) - not-present page [ 502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0 [ 502.717252] Oops: 0000 [#1] SMP [ 502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360 [ 502.732872] Call Trace: [ 502.733193] __blk_add_trace.cold+0x137/0x1a3 [ 502.733734] blk_add_trace_rq+0x7b/0xd0 [ 502.734207] blk_add_trace_rq_issue+0x54/0xa0 [ 502.734755] blk_mq_start_request+0xde/0x1b0 [ 502.735287] scsi_queue_rq+0x528/0x1140 ... [ 502.742704] sg_new_write.isra.0+0x16e/0x3e0 [ 502.747501] sg_ioctl+0x466/0x1100 Reproduce method: ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sda, BLKTRACESTART) ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sdb, BLKTRACESTART) echo 0 > /sys/block/sdb/trace/enable & // Add delay(mdelay/msleep) before kernel enters blk_trace_free() ioctl$SG_IO(/dev/sda, SG_IO, ...) // Enters trace_note_tsk() after blk_trace_free() returned // Use mdelay in rcu region rather than msleep(which may schedule out) Remove blk_trace from running_list before calling blk_trace_free() by sysfs if blk_trace is at Blktrace_running state.
Severity
6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-17 17:37 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c71a896154119f4ca9e89d6078f5f63ad60ef199 , < 488da313edf3abea7f7733efe011c96b23740ab5 (git)
Affected: c71a896154119f4ca9e89d6078f5f63ad60ef199 , < dacfd5e4d1142bfb3809aab3634a375f6f373269 (git)
Affected: c71a896154119f4ca9e89d6078f5f63ad60ef199 , < d56171d9360c0170c5c5f8f7e2362a2e999eca40 (git)
Affected: c71a896154119f4ca9e89d6078f5f63ad60ef199 , < 677e362ba807f3aafe6f405c07e0b37244da5222 (git)
Affected: c71a896154119f4ca9e89d6078f5f63ad60ef199 , < ebb8d26d93c3ec3c7576c52a8373a2309423c069 (git)
Affected: c71a896154119f4ca9e89d6078f5f63ad60ef199 , < 3815fe7371d2411ce164281cef40d9fc7b323dee (git)
Affected: c71a896154119f4ca9e89d6078f5f63ad60ef199 , < a5f8e86192612d0183047448d8bbe7918b3f1a26 (git)
Affected: c71a896154119f4ca9e89d6078f5f63ad60ef199 , < 5afedf670caf30a2b5a52da96eb7eac7dee6a9c9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 4.4.286 , ≤ 4.4.* (semver)
Unaffected: 4.9.285 , ≤ 4.9.* (semver)
Unaffected: 4.14.249 , ≤ 4.14.* (semver)
Unaffected: 4.19.209 , ≤ 4.19.* (semver)
Unaffected: 5.4.150 , ≤ 5.4.* (semver)
Unaffected: 5.10.70 , ≤ 5.10.* (semver)
Unaffected: 5.14.9 , ≤ 5.14.* (semver)
Unaffected: 5.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 6.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47375",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:37:23.607827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-27T13:59:18.148Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.654Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/488da313edf3abea7f7733efe011c96b23740ab5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dacfd5e4d1142bfb3809aab3634a375f6f373269"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d56171d9360c0170c5c5f8f7e2362a2e999eca40"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/677e362ba807f3aafe6f405c07e0b37244da5222"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ebb8d26d93c3ec3c7576c52a8373a2309423c069"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3815fe7371d2411ce164281cef40d9fc7b323dee"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a5f8e86192612d0183047448d8bbe7918b3f1a26"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5afedf670caf30a2b5a52da96eb7eac7dee6a9c9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/blktrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "488da313edf3abea7f7733efe011c96b23740ab5",
              "status": "affected",
              "version": "c71a896154119f4ca9e89d6078f5f63ad60ef199",
              "versionType": "git"
            },
            {
              "lessThan": "dacfd5e4d1142bfb3809aab3634a375f6f373269",
              "status": "affected",
              "version": "c71a896154119f4ca9e89d6078f5f63ad60ef199",
              "versionType": "git"
            },
            {
              "lessThan": "d56171d9360c0170c5c5f8f7e2362a2e999eca40",
              "status": "affected",
              "version": "c71a896154119f4ca9e89d6078f5f63ad60ef199",
              "versionType": "git"
            },
            {
              "lessThan": "677e362ba807f3aafe6f405c07e0b37244da5222",
              "status": "affected",
              "version": "c71a896154119f4ca9e89d6078f5f63ad60ef199",
              "versionType": "git"
            },
            {
              "lessThan": "ebb8d26d93c3ec3c7576c52a8373a2309423c069",
              "status": "affected",
              "version": "c71a896154119f4ca9e89d6078f5f63ad60ef199",
              "versionType": "git"
            },
            {
              "lessThan": "3815fe7371d2411ce164281cef40d9fc7b323dee",
              "status": "affected",
              "version": "c71a896154119f4ca9e89d6078f5f63ad60ef199",
              "versionType": "git"
            },
            {
              "lessThan": "a5f8e86192612d0183047448d8bbe7918b3f1a26",
              "status": "affected",
              "version": "c71a896154119f4ca9e89d6078f5f63ad60ef199",
              "versionType": "git"
            },
            {
              "lessThan": "5afedf670caf30a2b5a52da96eb7eac7dee6a9c9",
              "status": "affected",
              "version": "c71a896154119f4ca9e89d6078f5f63ad60ef199",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/blktrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.286",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.286",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.285",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.249",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.209",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.150",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.70",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.9",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblktrace: Fix uaf in blk_trace access after removing by sysfs\n\nThere is an use-after-free problem triggered by following process:\n\n      P1(sda)\t\t\t\tP2(sdb)\n\t\t\techo 0 \u003e /sys/block/sdb/trace/enable\n\t\t\t  blk_trace_remove_queue\n\t\t\t    synchronize_rcu\n\t\t\t    blk_trace_free\n\t\t\t      relay_close\nrcu_read_lock\n__blk_add_trace\n  trace_note_tsk\n  (Iterate running_trace_list)\n\t\t\t        relay_close_buf\n\t\t\t\t  relay_destroy_buf\n\t\t\t\t    kfree(buf)\n    trace_note(sdb\u0027s bt)\n      relay_reserve\n        buf-\u003eoffset \u003c- nullptr deference (use-after-free) !!!\nrcu_read_unlock\n\n[  502.714379] BUG: kernel NULL pointer dereference, address:\n0000000000000010\n[  502.715260] #PF: supervisor read access in kernel mode\n[  502.715903] #PF: error_code(0x0000) - not-present page\n[  502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0\n[  502.717252] Oops: 0000 [#1] SMP\n[  502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360\n[  502.732872] Call Trace:\n[  502.733193]  __blk_add_trace.cold+0x137/0x1a3\n[  502.733734]  blk_add_trace_rq+0x7b/0xd0\n[  502.734207]  blk_add_trace_rq_issue+0x54/0xa0\n[  502.734755]  blk_mq_start_request+0xde/0x1b0\n[  502.735287]  scsi_queue_rq+0x528/0x1140\n...\n[  502.742704]  sg_new_write.isra.0+0x16e/0x3e0\n[  502.747501]  sg_ioctl+0x466/0x1100\n\nReproduce method:\n  ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\n  ioctl(/dev/sda, BLKTRACESTART)\n  ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\n  ioctl(/dev/sdb, BLKTRACESTART)\n\n  echo 0 \u003e /sys/block/sdb/trace/enable \u0026\n  // Add delay(mdelay/msleep) before kernel enters blk_trace_free()\n\n  ioctl$SG_IO(/dev/sda, SG_IO, ...)\n  // Enters trace_note_tsk() after blk_trace_free() returned\n  // Use mdelay in rcu region rather than msleep(which may schedule out)\n\nRemove blk_trace from running_list before calling blk_trace_free() by\nsysfs if blk_trace is at Blktrace_running state."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:53:29.691Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/488da313edf3abea7f7733efe011c96b23740ab5"
        },
        {
          "url": "https://git.kernel.org/stable/c/dacfd5e4d1142bfb3809aab3634a375f6f373269"
        },
        {
          "url": "https://git.kernel.org/stable/c/d56171d9360c0170c5c5f8f7e2362a2e999eca40"
        },
        {
          "url": "https://git.kernel.org/stable/c/677e362ba807f3aafe6f405c07e0b37244da5222"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebb8d26d93c3ec3c7576c52a8373a2309423c069"
        },
        {
          "url": "https://git.kernel.org/stable/c/3815fe7371d2411ce164281cef40d9fc7b323dee"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5f8e86192612d0183047448d8bbe7918b3f1a26"
        },
        {
          "url": "https://git.kernel.org/stable/c/5afedf670caf30a2b5a52da96eb7eac7dee6a9c9"
        }
      ],
      "title": "blktrace: Fix uaf in blk_trace access after removing by sysfs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47375",
    "datePublished": "2024-05-21T15:03:39.090Z",
    "dateReserved": "2024-05-21T14:58:30.811Z",
    "dateUpdated": "2026-05-11T13:53:29.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47375",
      "date": "2026-09-16",
      "epss": "0.00254",
      "percentile": "0.17041"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblktrace: Fix uaf in blk_trace access after removing by sysfs\\n\\nThere is an use-after-free problem triggered by following process:\\n\\n      P1(sda)\\t\\t\\t\\tP2(sdb)\\n\\t\\t\\techo 0 \u003e /sys/block/sdb/trace/enable\\n\\t\\t\\t  blk_trace_remove_queue\\n\\t\\t\\t    synchronize_rcu\\n\\t\\t\\t    blk_trace_free\\n\\t\\t\\t      relay_close\\nrcu_read_lock\\n__blk_add_trace\\n  trace_note_tsk\\n  (Iterate running_trace_list)\\n\\t\\t\\t        relay_close_buf\\n\\t\\t\\t\\t  relay_destroy_buf\\n\\t\\t\\t\\t    kfree(buf)\\n    trace_note(sdb\u0027s bt)\\n      relay_reserve\\n        buf-\u003eoffset \u003c- nullptr deference (use-after-free) !!!\\nrcu_read_unlock\\n\\n[  502.714379] BUG: kernel NULL pointer dereference, address:\\n0000000000000010\\n[  502.715260] #PF: supervisor read access in kernel mode\\n[  502.715903] #PF: error_code(0x0000) - not-present page\\n[  502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0\\n[  502.717252] Oops: 0000 [#1] SMP\\n[  502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360\\n[  502.732872] Call Trace:\\n[  502.733193]  __blk_add_trace.cold+0x137/0x1a3\\n[  502.733734]  blk_add_trace_rq+0x7b/0xd0\\n[  502.734207]  blk_add_trace_rq_issue+0x54/0xa0\\n[  502.734755]  blk_mq_start_request+0xde/0x1b0\\n[  502.735287]  scsi_queue_rq+0x528/0x1140\\n...\\n[  502.742704]  sg_new_write.isra.0+0x16e/0x3e0\\n[  502.747501]  sg_ioctl+0x466/0x1100\\n\\nReproduce method:\\n  ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\\n  ioctl(/dev/sda, BLKTRACESTART)\\n  ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\\n  ioctl(/dev/sdb, BLKTRACESTART)\\n\\n  echo 0 \u003e /sys/block/sdb/trace/enable \u0026\\n  // Add delay(mdelay/msleep) before kernel enters blk_trace_free()\\n\\n  ioctl$SG_IO(/dev/sda, SG_IO, ...)\\n  // Enters trace_note_tsk() after blk_trace_free() returned\\n  // Use mdelay in rcu region rather than msleep(which may schedule out)\\n\\nRemove blk_trace from running_list before calling blk_trace_free() by\\nsysfs if blk_trace is at Blktrace_running state.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: blktrace: corrige uaf en el acceso a blk_trace despu\\u00e9s de eliminarlo mediante sysfs. Hay un problema de use after free desencadenado por el siguiente proceso: P1(sda) P2(sdb) echo 0 \u0026gt; /sys /block/sdb/trace/enable blk_trace_remove_queue sincronizar_rcu blk_trace_free rel\\u00e9_cerrar rcu_read_lock __blk_add_trace trace_note_tsk (Iterar running_trace_list) rel\\u00e9_close_buf rel\\u00e9_destroy_buf kfree(buf) trace_note(sdb\u0027s bt) rel\\u00e9_reserve buf-\u0026gt;offset \u0026lt;- deferencia nullptr (uso-despu\\u00e9s) -gratis) !!! rcu_read_unlock [502.714379] ERROR: desreferencia del puntero NULL del kernel, direcci\\u00f3n: 0000000000000010 [502.715260] #PF: acceso de lectura de supervisor en modo kernel [502.715903] #PF: error_code(0x0000) - p\\u00e1gina no presente [502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0 [ 502.717252] Vaya: 0000 [#1] SMP [ 502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360 [ 502.732872] Seguimiento de llamadas: [ 502.733193] 0x1a3 [502.733734] blk_add_trace_rq+ 0x7b/0xd0 [ 502.734207] blk_add_trace_rq_issue+0x54/0xa0 [ 502.734755] blk_mq_start_request+0xde/0x1b0 [ 502.735287] scsi_queue_rq+0x528/0x1140 ... [ 502.7427 04] sg_new_write.isra.0+0x16e/0x3e0 [ 502.747501] sg_ioctl+0x466/0x1100 M\\u00e9todo de reproducci\\u00f3n: ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sda, BLKTRACESTART) ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sdb , BLKTRACESTART) echo 0 \u0026gt; /sys/block/sdb/trace/enable \u0026amp; // Agrega retraso(mdelay/msleep) antes de que el kernel entre blk_trace_free() ioctl$SG_IO(/dev/sda, SG_IO, ...) // Entra trace_note_tsk() despu\\u00e9s de que blk_trace_free() regresara // Utilice mdelay en la regi\\u00f3n rcu en lugar de msleep (que puede programarse) Elimine blk_trace de running_list antes de llamar a blk_trace_free() mediante sysfs si blk_trace est\\u00e1 en el estado Blktrace_running.\"}]",
      "id": "CVE-2021-47375",
      "lastModified": "2024-11-21T06:36:00.920",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 6.2, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.5, \"impactScore\": 3.6}]}",
      "published": "2024-05-21T15:15:23.290",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/3815fe7371d2411ce164281cef40d9fc7b323dee\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/488da313edf3abea7f7733efe011c96b23740ab5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5afedf670caf30a2b5a52da96eb7eac7dee6a9c9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/677e362ba807f3aafe6f405c07e0b37244da5222\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a5f8e86192612d0183047448d8bbe7918b3f1a26\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d56171d9360c0170c5c5f8f7e2362a2e999eca40\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/dacfd5e4d1142bfb3809aab3634a375f6f373269\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ebb8d26d93c3ec3c7576c52a8373a2309423c069\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3815fe7371d2411ce164281cef40d9fc7b323dee\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/488da313edf3abea7f7733efe011c96b23740ab5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/5afedf670caf30a2b5a52da96eb7eac7dee6a9c9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/677e362ba807f3aafe6f405c07e0b37244da5222\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a5f8e86192612d0183047448d8bbe7918b3f1a26\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d56171d9360c0170c5c5f8f7e2362a2e999eca40\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/dacfd5e4d1142bfb3809aab3634a375f6f373269\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ebb8d26d93c3ec3c7576c52a8373a2309423c069\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47375\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:23.290\",\"lastModified\":\"2026-06-17T04:17:19.560\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblktrace: Fix uaf in blk_trace access after removing by sysfs\\n\\nThere is an use-after-free problem triggered by following process:\\n\\n      P1(sda)\\t\\t\\t\\tP2(sdb)\\n\\t\\t\\techo 0 \u003e /sys/block/sdb/trace/enable\\n\\t\\t\\t  blk_trace_remove_queue\\n\\t\\t\\t    synchronize_rcu\\n\\t\\t\\t    blk_trace_free\\n\\t\\t\\t      relay_close\\nrcu_read_lock\\n__blk_add_trace\\n  trace_note_tsk\\n  (Iterate running_trace_list)\\n\\t\\t\\t        relay_close_buf\\n\\t\\t\\t\\t  relay_destroy_buf\\n\\t\\t\\t\\t    kfree(buf)\\n    trace_note(sdb\u0027s bt)\\n      relay_reserve\\n        buf-\u003eoffset \u003c- nullptr deference (use-after-free) !!!\\nrcu_read_unlock\\n\\n[  502.714379] BUG: kernel NULL pointer dereference, address:\\n0000000000000010\\n[  502.715260] #PF: supervisor read access in kernel mode\\n[  502.715903] #PF: error_code(0x0000) - not-present page\\n[  502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0\\n[  502.717252] Oops: 0000 [#1] SMP\\n[  502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360\\n[  502.732872] Call Trace:\\n[  502.733193]  __blk_add_trace.cold+0x137/0x1a3\\n[  502.733734]  blk_add_trace_rq+0x7b/0xd0\\n[  502.734207]  blk_add_trace_rq_issue+0x54/0xa0\\n[  502.734755]  blk_mq_start_request+0xde/0x1b0\\n[  502.735287]  scsi_queue_rq+0x528/0x1140\\n...\\n[  502.742704]  sg_new_write.isra.0+0x16e/0x3e0\\n[  502.747501]  sg_ioctl+0x466/0x1100\\n\\nReproduce method:\\n  ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\\n  ioctl(/dev/sda, BLKTRACESTART)\\n  ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\\n  ioctl(/dev/sdb, BLKTRACESTART)\\n\\n  echo 0 \u003e /sys/block/sdb/trace/enable \u0026\\n  // Add delay(mdelay/msleep) before kernel enters blk_trace_free()\\n\\n  ioctl$SG_IO(/dev/sda, SG_IO, ...)\\n  // Enters trace_note_tsk() after blk_trace_free() returned\\n  // Use mdelay in rcu region rather than msleep(which may schedule out)\\n\\nRemove blk_trace from running_list before calling blk_trace_free() by\\nsysfs if blk_trace is at Blktrace_running state.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: blktrace: corrige uaf en el acceso a blk_trace despu\u00e9s de eliminarlo mediante sysfs. Hay un problema de use after free desencadenado por el siguiente proceso: P1(sda) P2(sdb) echo 0 \u0026gt; /sys /block/sdb/trace/enable blk_trace_remove_queue sincronizar_rcu blk_trace_free rel\u00e9_cerrar rcu_read_lock __blk_add_trace trace_note_tsk (Iterar running_trace_list) rel\u00e9_close_buf rel\u00e9_destroy_buf kfree(buf) trace_note(sdb\u0027s bt) rel\u00e9_reserve buf-\u0026gt;offset \u0026lt;- deferencia nullptr (uso-despu\u00e9s) -gratis) !!! rcu_read_unlock [502.714379] ERROR: desreferencia del puntero NULL del kernel, direcci\u00f3n: 0000000000000010 [502.715260] #PF: acceso de lectura de supervisor en modo kernel [502.715903] #PF: error_code(0x0000) - p\u00e1gina no presente [502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0 [ 502.717252] Vaya: 0000 [#1] SMP [ 502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360 [ 502.732872] Seguimiento de llamadas: [ 502.733193] 0x1a3 [502.733734] blk_add_trace_rq+ 0x7b/0xd0 [ 502.734207] blk_add_trace_rq_issue+0x54/0xa0 [ 502.734755] blk_mq_start_request+0xde/0x1b0 [ 502.735287] scsi_queue_rq+0x528/0x1140 ... [ 502.7427 04] sg_new_write.isra.0+0x16e/0x3e0 [ 502.747501] sg_ioctl+0x466/0x1100 M\u00e9todo de reproducci\u00f3n: ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sda, BLKTRACESTART) ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sdb , BLKTRACESTART) echo 0 \u0026gt; /sys/block/sdb/trace/enable \u0026amp; // Agrega retraso(mdelay/msleep) antes de que el kernel entre blk_trace_free() ioctl$SG_IO(/dev/sda, SG_IO, ...) // Entra trace_note_tsk() despu\u00e9s de que blk_trace_free() regresara // Utilice mdelay en la regi\u00f3n rcu en lugar de msleep (que puede programarse) Elimine blk_trace de running_list antes de llamar a blk_trace_free() mediante sysfs si blk_trace est\u00e1 en el estado Blktrace_running.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/blktrace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c71a896154119f4ca9e89d6078f5f63ad60ef199\",\"lessThan\":\"488da313edf3abea7f7733efe011c96b23740ab5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71a896154119f4ca9e89d6078f5f63ad60ef199\",\"lessThan\":\"dacfd5e4d1142bfb3809aab3634a375f6f373269\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71a896154119f4ca9e89d6078f5f63ad60ef199\",\"lessThan\":\"d56171d9360c0170c5c5f8f7e2362a2e999eca40\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71a896154119f4ca9e89d6078f5f63ad60ef199\",\"lessThan\":\"677e362ba807f3aafe6f405c07e0b37244da5222\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71a896154119f4ca9e89d6078f5f63ad60ef199\",\"lessThan\":\"ebb8d26d93c3ec3c7576c52a8373a2309423c069\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71a896154119f4ca9e89d6078f5f63ad60ef199\",\"lessThan\":\"3815fe7371d2411ce164281cef40d9fc7b323dee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71a896154119f4ca9e89d6078f5f63ad60ef199\",\"lessThan\":\"a5f8e86192612d0183047448d8bbe7918b3f1a26\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71a896154119f4ca9e89d6078f5f63ad60ef199\",\"lessThan\":\"5afedf670caf30a2b5a52da96eb7eac7dee6a9c9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/blktrace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.30\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.30\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.4.286\",\"lessThanOrEqual\":\"4.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.285\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.249\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.209\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.150\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.70\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.14.9\",\"lessThanOrEqual\":\"5.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.5,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-17T17:37:23.607827Z\",\"id\":\"CVE-2021-47375\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.30\",\"versionEndExcluding\":\"4.4.286\",\"matchCriteriaId\":\"157EDB40-6A7D-4DA4-8B53-B0E1B429365E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.5\",\"versionEndExcluding\":\"4.9.285\",\"matchCriteriaId\":\"531DC051-E22F-4355-A06F-BE9AF2124AA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.249\",\"matchCriteriaId\":\"9DFC8239-9F26-43B2-A340-8EFC6BC6BDA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.209\",\"matchCriteriaId\":\"21C23429-F802-4256-B3C2-9EEA76AC11FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.150\",\"matchCriteriaId\":\"87771E47-210D-48FA-95BC-48A86225B30F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.70\",\"matchCriteriaId\":\"A2A50090-4483-4F44-9147-BF0B012FBF7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.14.9\",\"matchCriteriaId\":\"1B31D6C1-A751-438D-906B-0C56B789D498\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E46C74C6-B76B-4C94-A6A4-FD2FFF62D644\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"60134C3A-06E4-48C1-B04F-2903732A4E56\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3815fe7371d2411ce164281cef40d9fc7b323dee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/488da313edf3abea7f7733efe011c96b23740ab5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5afedf670caf30a2b5a52da96eb7eac7dee6a9c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/677e362ba807f3aafe6f405c07e0b37244da5222\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a5f8e86192612d0183047448d8bbe7918b3f1a26\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d56171d9360c0170c5c5f8f7e2362a2e999eca40\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dacfd5e4d1142bfb3809aab3634a375f6f373269\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ebb8d26d93c3ec3c7576c52a8373a2309423c069\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3815fe7371d2411ce164281cef40d9fc7b323dee\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/488da313edf3abea7f7733efe011c96b23740ab5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5afedf670caf30a2b5a52da96eb7eac7dee6a9c9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/677e362ba807f3aafe6f405c07e0b37244da5222\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a5f8e86192612d0183047448d8bbe7918b3f1a26\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d56171d9360c0170c5c5f8f7e2362a2e999eca40\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dacfd5e4d1142bfb3809aab3634a375f6f373269\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ebb8d26d93c3ec3c7576c52a8373a2309423c069\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-02-02T10:48:42+00:00",
      "cve": "CVE-2021-47375",
      "id": "CVE-2021-47375",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: blktrace: Fix uaf in blk_trace access after removing by sysfs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47375.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T23:56:01Z",
      "cve": "CVE-2021-47375",
      "id": "CVE-2021-47375",
      "initial_release_date": "2024-05-24T15:21:32Z",
      "product_status:known_affected": "374",
      "product_status:known_not_affected": "107",
      "product_status:recommended": "657",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47375",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47375.json",
      "version": "60"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/488da313edf3abea7f7733efe011c96b23740ab5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/dacfd5e4d1142bfb3809aab3634a375f6f373269\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d56171d9360c0170c5c5f8f7e2362a2e999eca40\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/677e362ba807f3aafe6f405c07e0b37244da5222\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ebb8d26d93c3ec3c7576c52a8373a2309423c069\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3815fe7371d2411ce164281cef40d9fc7b323dee\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a5f8e86192612d0183047448d8bbe7918b3f1a26\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5afedf670caf30a2b5a52da96eb7eac7dee6a9c9\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:08.654Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47375\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T17:37:23.607827Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T17:37:24.813Z\"}}], \"cna\": {\"title\": \"blktrace: Fix uaf in blk_trace access after removing by sysfs\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c71a896154119f4ca9e89d6078f5f63ad60ef199\", \"lessThan\": \"488da313edf3abea7f7733efe011c96b23740ab5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c71a896154119f4ca9e89d6078f5f63ad60ef199\", \"lessThan\": \"dacfd5e4d1142bfb3809aab3634a375f6f373269\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c71a896154119f4ca9e89d6078f5f63ad60ef199\", \"lessThan\": \"d56171d9360c0170c5c5f8f7e2362a2e999eca40\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c71a896154119f4ca9e89d6078f5f63ad60ef199\", \"lessThan\": \"677e362ba807f3aafe6f405c07e0b37244da5222\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c71a896154119f4ca9e89d6078f5f63ad60ef199\", \"lessThan\": \"ebb8d26d93c3ec3c7576c52a8373a2309423c069\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c71a896154119f4ca9e89d6078f5f63ad60ef199\", \"lessThan\": \"3815fe7371d2411ce164281cef40d9fc7b323dee\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c71a896154119f4ca9e89d6078f5f63ad60ef199\", \"lessThan\": \"a5f8e86192612d0183047448d8bbe7918b3f1a26\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c71a896154119f4ca9e89d6078f5f63ad60ef199\", \"lessThan\": \"5afedf670caf30a2b5a52da96eb7eac7dee6a9c9\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/trace/blktrace.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.30\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.30\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.4.286\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.4.*\"}, {\"status\": \"unaffected\", \"version\": \"4.9.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.249\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.209\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.150\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.70\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/trace/blktrace.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/488da313edf3abea7f7733efe011c96b23740ab5\"}, {\"url\": \"https://git.kernel.org/stable/c/dacfd5e4d1142bfb3809aab3634a375f6f373269\"}, {\"url\": \"https://git.kernel.org/stable/c/d56171d9360c0170c5c5f8f7e2362a2e999eca40\"}, {\"url\": \"https://git.kernel.org/stable/c/677e362ba807f3aafe6f405c07e0b37244da5222\"}, {\"url\": \"https://git.kernel.org/stable/c/ebb8d26d93c3ec3c7576c52a8373a2309423c069\"}, {\"url\": \"https://git.kernel.org/stable/c/3815fe7371d2411ce164281cef40d9fc7b323dee\"}, {\"url\": \"https://git.kernel.org/stable/c/a5f8e86192612d0183047448d8bbe7918b3f1a26\"}, {\"url\": \"https://git.kernel.org/stable/c/5afedf670caf30a2b5a52da96eb7eac7dee6a9c9\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblktrace: Fix uaf in blk_trace access after removing by sysfs\\n\\nThere is an use-after-free problem triggered by following process:\\n\\n      P1(sda)\\t\\t\\t\\tP2(sdb)\\n\\t\\t\\techo 0 \u003e /sys/block/sdb/trace/enable\\n\\t\\t\\t  blk_trace_remove_queue\\n\\t\\t\\t    synchronize_rcu\\n\\t\\t\\t    blk_trace_free\\n\\t\\t\\t      relay_close\\nrcu_read_lock\\n__blk_add_trace\\n  trace_note_tsk\\n  (Iterate running_trace_list)\\n\\t\\t\\t        relay_close_buf\\n\\t\\t\\t\\t  relay_destroy_buf\\n\\t\\t\\t\\t    kfree(buf)\\n    trace_note(sdb\u0027s bt)\\n      relay_reserve\\n        buf-\u003eoffset \u003c- nullptr deference (use-after-free) !!!\\nrcu_read_unlock\\n\\n[  502.714379] BUG: kernel NULL pointer dereference, address:\\n0000000000000010\\n[  502.715260] #PF: supervisor read access in kernel mode\\n[  502.715903] #PF: error_code(0x0000) - not-present page\\n[  502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0\\n[  502.717252] Oops: 0000 [#1] SMP\\n[  502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360\\n[  502.732872] Call Trace:\\n[  502.733193]  __blk_add_trace.cold+0x137/0x1a3\\n[  502.733734]  blk_add_trace_rq+0x7b/0xd0\\n[  502.734207]  blk_add_trace_rq_issue+0x54/0xa0\\n[  502.734755]  blk_mq_start_request+0xde/0x1b0\\n[  502.735287]  scsi_queue_rq+0x528/0x1140\\n...\\n[  502.742704]  sg_new_write.isra.0+0x16e/0x3e0\\n[  502.747501]  sg_ioctl+0x466/0x1100\\n\\nReproduce method:\\n  ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\\n  ioctl(/dev/sda, BLKTRACESTART)\\n  ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\\n  ioctl(/dev/sdb, BLKTRACESTART)\\n\\n  echo 0 \u003e /sys/block/sdb/trace/enable \u0026\\n  // Add delay(mdelay/msleep) before kernel enters blk_trace_free()\\n\\n  ioctl$SG_IO(/dev/sda, SG_IO, ...)\\n  // Enters trace_note_tsk() after blk_trace_free() returned\\n  // Use mdelay in rcu region rather than msleep(which may schedule out)\\n\\nRemove blk_trace from running_list before calling blk_trace_free() by\\nsysfs if blk_trace is at Blktrace_running state.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.4.286\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.285\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.249\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.209\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.150\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.70\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14.9\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15\", \"versionStartIncluding\": \"2.6.30\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:09:38.500Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47375\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T07:09:38.500Z\", \"dateReserved\": \"2024-05-21T14:58:30.811Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:03:39.090Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.