cve-2021-47603
Vulnerability from cvelistv5
Published
2024-06-19 14:54
Modified
2024-11-04 12:08
Severity ?
Summary
audit: improve robustness of the audit queue handling
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0d3277eabd542fb662be23696e5ec9f390d688e1Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4cc6badff97f74d0fce65f9784b5df3b64e4250bPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/75fdb751f84727d614deea0571a1490c3225d83aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8389f50ceb854cb437fefb9330d5024ed3c7c1f5Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a5f4d17daf2e6cd7c1d9676b476147f6b4ac53f2Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f4b3ee3c85551d2d343a3ba159304066523f730fPatch
Impacted products
Vendor Product Version
Linux Linux Version: 4.11
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47603",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-20T13:46:15.530530Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T13:46:23.577Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:47:40.675Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/75fdb751f84727d614deea0571a1490c3225d83a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8389f50ceb854cb437fefb9330d5024ed3c7c1f5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0d3277eabd542fb662be23696e5ec9f390d688e1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4cc6badff97f74d0fce65f9784b5df3b64e4250b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a5f4d17daf2e6cd7c1d9676b476147f6b4ac53f2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f4b3ee3c85551d2d343a3ba159304066523f730f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/audit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "75fdb751f847",
              "status": "affected",
              "version": "5b52330bbfe6",
              "versionType": "git"
            },
            {
              "lessThan": "8389f50ceb85",
              "status": "affected",
              "version": "5b52330bbfe6",
              "versionType": "git"
            },
            {
              "lessThan": "0d3277eabd54",
              "status": "affected",
              "version": "5b52330bbfe6",
              "versionType": "git"
            },
            {
              "lessThan": "4cc6badff97f",
              "status": "affected",
              "version": "5b52330bbfe6",
              "versionType": "git"
            },
            {
              "lessThan": "a5f4d17daf2e",
              "status": "affected",
              "version": "5b52330bbfe6",
              "versionType": "git"
            },
            {
              "lessThan": "f4b3ee3c8555",
              "status": "affected",
              "version": "5b52330bbfe6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/audit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: improve robustness of the audit queue handling\n\nIf the audit daemon were ever to get stuck in a stopped state the\nkernel\u0027s kauditd_thread() could get blocked attempting to send audit\nrecords to the userspace audit daemon.  With the kernel thread\nblocked it is possible that the audit queue could grow unbounded as\ncertain audit record generating events must be exempt from the queue\nlimits else the system enter a deadlock state.\n\nThis patch resolves this problem by lowering the kernel thread\u0027s\nsocket sending timeout from MAX_SCHEDULE_TIMEOUT to HZ/10 and tweaks\nthe kauditd_send_queue() function to better manage the various audit\nqueues when connection problems occur between the kernel and the\naudit daemon.  With this patch, the backlog may temporarily grow\nbeyond the defined limits when the audit daemon is stopped and the\nsystem is under heavy audit pressure, but kauditd_thread() will\ncontinue to make progress and drain the queues as it would for other\nconnection problems.  For example, with the audit daemon put into a\nstopped state and the system configured to audit every syscall it\nwas still possible to shutdown the system without a kernel panic,\ndeadlock, etc.; granted, the system was slow to shutdown but that is\nto be expected given the extreme pressure of recording every syscall.\n\nThe timeout value of HZ/10 was chosen primarily through\nexperimentation and this developer\u0027s \"gut feeling\".  There is likely\nno one perfect value, but as this scenario is limited in scope (root\nprivileges would be needed to send SIGSTOP to the audit daemon), it\nis likely not worth exposing this as a tunable at present.  This can\nalways be done at a later date if it proves necessary."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-04T12:08:58.700Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/75fdb751f84727d614deea0571a1490c3225d83a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8389f50ceb854cb437fefb9330d5024ed3c7c1f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d3277eabd542fb662be23696e5ec9f390d688e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cc6badff97f74d0fce65f9784b5df3b64e4250b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5f4d17daf2e6cd7c1d9676b476147f6b4ac53f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4b3ee3c85551d2d343a3ba159304066523f730f"
        }
      ],
      "title": "audit: improve robustness of the audit queue handling",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47603",
    "datePublished": "2024-06-19T14:54:02.988Z",
    "dateReserved": "2024-05-24T15:11:00.736Z",
    "dateUpdated": "2024-11-04T12:08:58.700Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47603\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T15:15:54.863\",\"lastModified\":\"2024-10-31T13:46:39.310\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naudit: improve robustness of the audit queue handling\\n\\nIf the audit daemon were ever to get stuck in a stopped state the\\nkernel\u0027s kauditd_thread() could get blocked attempting to send audit\\nrecords to the userspace audit daemon.  With the kernel thread\\nblocked it is possible that the audit queue could grow unbounded as\\ncertain audit record generating events must be exempt from the queue\\nlimits else the system enter a deadlock state.\\n\\nThis patch resolves this problem by lowering the kernel thread\u0027s\\nsocket sending timeout from MAX_SCHEDULE_TIMEOUT to HZ/10 and tweaks\\nthe kauditd_send_queue() function to better manage the various audit\\nqueues when connection problems occur between the kernel and the\\naudit daemon.  With this patch, the backlog may temporarily grow\\nbeyond the defined limits when the audit daemon is stopped and the\\nsystem is under heavy audit pressure, but kauditd_thread() will\\ncontinue to make progress and drain the queues as it would for other\\nconnection problems.  For example, with the audit daemon put into a\\nstopped state and the system configured to audit every syscall it\\nwas still possible to shutdown the system without a kernel panic,\\ndeadlock, etc.; granted, the system was slow to shutdown but that is\\nto be expected given the extreme pressure of recording every syscall.\\n\\nThe timeout value of HZ/10 was chosen primarily through\\nexperimentation and this developer\u0027s \\\"gut feeling\\\".  There is likely\\nno one perfect value, but as this scenario is limited in scope (root\\nprivileges would be needed to send SIGSTOP to the audit daemon), it\\nis likely not worth exposing this as a tunable at present.  This can\\nalways be done at a later date if it proves necessary.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: auditor\u00eda: mejora la solidez del manejo de la cola de auditor\u00eda. Si el daemon de auditor\u00eda alguna vez se atascara en un estado detenido, kauditd_thread() del kernel podr\u00eda bloquearse al intentar enviar registros de auditor\u00eda al espacio de usuario. daemon de auditor\u00eda. Con el subproceso del n\u00facleo bloqueado, es posible que la cola de auditor\u00eda crezca sin l\u00edmites, ya que ciertos eventos que generan registros de auditor\u00eda deben estar exentos de los l\u00edmites de la cola, de lo contrario, el sistema entrar\u00e1 en un estado de bloqueo. Este parche resuelve este problema reduciendo el tiempo de espera de env\u00edo del socket del subproceso del n\u00facleo de MAX_SCHEDULE_TIMEOUT a HZ/10 y modifica la funci\u00f3n kauditd_send_queue() para gestionar mejor las distintas colas de auditor\u00eda cuando se producen problemas de conexi\u00f3n entre el n\u00facleo y el daemon de auditor\u00eda. Con este parche, el trabajo pendiente puede crecer temporalmente m\u00e1s all\u00e1 de los l\u00edmites definidos cuando se detiene el daemon de auditor\u00eda y el sistema est\u00e1 bajo una fuerte presi\u00f3n de auditor\u00eda, pero kauditd_thread() continuar\u00e1 progresando y drenando las colas como lo har\u00eda con otros problemas de conexi\u00f3n. Por ejemplo, con el daemon de auditor\u00eda en estado detenido y el sistema configurado para auditar cada llamada al sistema, a\u00fan era posible apagar el sistema sin p\u00e1nico en el kernel, interbloqueo, etc.; Por supuesto, el sistema tard\u00f3 en cerrarse, pero eso es de esperarse dada la presi\u00f3n extrema de registrar cada llamada al sistema. El valor de tiempo de espera de HZ/10 se eligi\u00f3 principalmente a trav\u00e9s de la experimentaci\u00f3n y el \\\"instinto\\\" de este desarrollador. Probablemente no exista un valor perfecto, pero como este escenario tiene un alcance limitado (se necesitar\u00edan privilegios de root para enviar SIGSTOP al daemon de auditor\u00eda), probablemente no valga la pena exponerlo como un ajuste ajustable en este momento. Esto siempre se puede hacer en una fecha posterior si resulta necesario.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":4.4,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":0.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10.7\",\"versionEndExcluding\":\"4.11\",\"matchCriteriaId\":\"002AFF57-621F-4DFC-BA33-323006B9E2CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.11\",\"versionEndExcluding\":\"4.14.259\",\"matchCriteriaId\":\"F52B82B4-2759-4BAE-914F-9BCD47B64147\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.222\",\"matchCriteriaId\":\"2D0D89BC-6CF8-4BFB-8C91-472348052528\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.168\",\"matchCriteriaId\":\"195EBAA1-4CCE-4898-9351-F4A0DBCAA022\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.88\",\"matchCriteriaId\":\"A657B2D0-5B9D-42BE-A3BF-228DBC1B057C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.11\",\"matchCriteriaId\":\"11274E95-438A-449A-B100-01B2B0046669\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"357AA433-37E8-4323-BFB2-3038D6E4B414\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A73429BA-C2D9-4D0C-A75F-06A1CA8B3983\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F621B5E3-E99D-49E7-90B9-EC3B77C95383\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7BFDCAA-1650-49AA-8462-407DD593F94F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"6EC9882F-866D-4ACB-8FBC-213D8D8436C8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d3277eabd542fb662be23696e5ec9f390d688e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4cc6badff97f74d0fce65f9784b5df3b64e4250b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/75fdb751f84727d614deea0571a1490c3225d83a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8389f50ceb854cb437fefb9330d5024ed3c7c1f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a5f4d17daf2e6cd7c1d9676b476147f6b4ac53f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f4b3ee3c85551d2d343a3ba159304066523f730f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.