CVE-2021-47011

published 2024-02-28

CVE-2021-47011: In the Linux kernel, the following vulnerability has been resolved: mm: memcontrol: slab: fix obtain a reference to a freeing memcg Patch series "Use…

Priority P4 21 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

mm: memcontrol: slab: fix obtain a reference to a freeing memcg

Patch series "Use obj_cgroup APIs to charge kmem pages", v5.

Since Roman's series "The new cgroup slab memory controller" applied.
All slab objects are charged with the new APIs of obj_cgroup. The new
APIs introduce a struct obj_cgroup to charge slab objects. It prevents
long-living objects from pinning the original memory cgroup in the
memory. But there are still some corner objects (e.g. allocations
larger than order-1 page on SLUB) which are not charged with the new
APIs. Those objects (include the pages which are allocated from buddy
allocator directly) are charged as kmem pages which still hold a
reference to the memory cgroup.

E.g. We know that the kernel stack is charged as kmem pages because the
size of the kernel stack can be greater than 2 pages (e.g. 16KB on
x86_64 or arm64). If we create a thread (suppose the thread stack is
charged to memory cgroup A) and then move it from memory cgroup A to
memory cgroup B. Because the kernel stack of the thread hold a
reference to the memory cgroup A. The thread can pin the memory cgroup
A in the memory even if we remove the cgroup A. If we want to see this
scenario by using the following script. We can see that the system has
added 500 dying cgroups (This is not a real world issue, just a script
to show that the large kmallocs are charged as kmem pages which can pin
the memory cgroup in the memory).

#!/bin/bash

cat /proc/cgroups | grep memory

cd /sys/fs/cgroup/memory
echo 1 > memory.move_charge_at_immigrate

for i in range{1..500}
do
mkdir kmem_test
echo $$ > kmem_test/cgroup.procs
sleep 3600 &
echo $$ > cgroup.procs
echo `cat kmem_test/cgroup.procs` > cgroup.procs
rmdir kmem_test
done

cat /proc/cgroups | grep memory

This patchset aims to make those kmem pages to drop the reference to
memory cgroup by using the APIs of obj_cgroup. Finally, we can see that
the number of the dying

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.10.38-1 (bookworm)	linux 5.10.38-1 (bookworm)
linux	linux	—	—
linux	linux	>= 26f54dac15640c65ec69867e182de7be708ea389 < 31df8bc4d3feca9f9c6b2cd06fd64a111ae1a0e6	31df8bc4d3feca9f9c6b2cd06fd64a111ae1a0e6
linux	linux	>= 3de7d4f25a7438f09fef4e71ef111f1805cd8e7c < 89b1ed358e01e1b0417f5d3b0082359a23355552	89b1ed358e01e1b0417f5d3b0082359a23355552
linux	linux	>= 3de7d4f25a7438f09fef4e71ef111f1805cd8e7c < c3ae6a3f3ca4f02f6ccddf213c027302586580d0	c3ae6a3f3ca4f02f6ccddf213c027302586580d0
linux	linux	>= 3de7d4f25a7438f09fef4e71ef111f1805cd8e7c < 9f38f03ae8d5f57371b71aa6b4275765b65454fd	9f38f03ae8d5f57371b71aa6b4275765b65454fd
linux	linux	>= 5.10.11 < 5.10.37	5.10.37
linux	linux_kernel	>= 0 < 5.10.38-1	5.10.38-1
linux	linux_kernel	>= 0 < 5.10.38-1	5.10.38-1
linux	linux_kernel	>= 0 < 5.10.38-1	5.10.38-1
linux	linux_kernel	>= 0 < 5.10.38-1	5.10.38-1
linux	linux_kernel	>= 5.10.11 < 5.10.37	5.10.37
linux	linux_kernel	>= 5.11 < 5.11.21	5.11.21
linux	linux_kernel	>= 5.12 < 5.12.4	5.12.4

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416