CVE-2021-47069

published 2024-03-01

CVE-2021-47069: In the Linux kernel, the following vulnerability has been resolved: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry do_mq_timedreceive…

Priority P4 31 high 7 CVSS 3.1

AV L AC H PR L UI N S U C H I H A H

In the Linux kernel, the following vulnerability has been resolved:

ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry

do_mq_timedreceive calls wq_sleep with a stack local address. The
sender (do_mq_timedsend) uses this address to later call pipelined_send.

This leads to a very hard to trigger race where a do_mq_timedreceive
call might return and leave do_mq_timedsend to rely on an invalid
address, causing the following crash:

RIP: 0010:wake_q_add_safe+0x13/0x60
Call Trace:
__x64_sys_mq_timedsend+0x2a9/0x490
do_syscall_64+0x80/0x680
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f5928e40343

The race occurs as:

1. do_mq_timedreceive calls wq_sleep with the address of `struct
ext_wait_queue` on function stack (aliased as `ewq_addr` here) - it
holds a valid `struct ext_wait_queue *` as long as the stack has not
been overwritten.

2. `ewq_addr` gets added to info->e_wait_q[RECV].list in wq_add, and
do_mq_timedsend receives it via wq_get_first_waiter(info, RECV) to call
__pipelined_op.

3. Sender calls __pipelined_op::smp_store_release(&this->state,
STATE_READY). Here is where the race window begins. (`this` is
`ewq_addr`.)

4. If the receiver wakes up now in do_mq_timedreceive::wq_sleep, it
will see `state == STATE_READY` and break.

5. do_mq_timedreceive returns, and `ewq_addr` is no longer guaranteed
to be a `struct ext_wait_queue *` since it was on do_mq_timedreceive's
stack. (Although the address may not get overwritten until another
function happens to touch it, which means it can persist around for an
indefinite time.)

6. do_mq_timedsend::__pipelined_op() still believes `ewq_addr` is a
`struct ext_wait_queue *`, and uses it to find a task_struct to pass to
the wake_q_add_safe call. In the lucky case where nothing has
overwritten `ewq_addr` yet, `ewq_addr->task` is the right task_struct.
In the unlucky case, __pipelined_op::wake_q_add_safe gets handed a
bogus address as the receiver's task_struct causing the crash.

do_mq_timedse

Affected

12 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.10.40-1 (bookworm)	linux 5.10.40-1 (bookworm)
linux	linux	—	—
linux	linux	>= c5b2cbdbdac563f46ecd5e187253ab1abbd6fc04 < 4528c0c323085e645b8765913b4a7fd42cf49b65	4528c0c323085e645b8765913b4a7fd42cf49b65
linux	linux	>= c5b2cbdbdac563f46ecd5e187253ab1abbd6fc04 < 807fa14536b26803b858da878b643be72952a097	807fa14536b26803b858da878b643be72952a097
linux	linux	>= c5b2cbdbdac563f46ecd5e187253ab1abbd6fc04 < a11ddb37bf367e6b5239b95ca759e5389bb46048	a11ddb37bf367e6b5239b95ca759e5389bb46048
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.40-1	5.10.40-1
linux	linux_kernel	>= 0 < 5.10.40-1	5.10.40-1
linux	linux_kernel	>= 0 < 5.10.40-1	5.10.40-1
linux	linux_kernel	>= 0 < 5.10.40-1	5.10.40-1
linux	linux_kernel	>= 5.11 < 5.12.7	5.12.7
linux	linux_kernel	>= 5.6 < 5.10.40	5.10.40

CVSS provenance

nvd v3.1 7.0 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

osv 7.0 HIGH

vendor_debian 7.0 HIGH

vendor_redhat 7.0 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-672 CWE-362