CVE-2021-47118
published 2024-03-15CVE-2021-47118: In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when initializing `cad_pid` During boot, kernel_init_freeable()…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.25%
15.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
pid: take a reference when initializing `cad_pid`
During boot, kernel_init_freeable() initializes `cad_pid` to the init
task's struct pid. Later on, we may change `cad_pid` via a sysctl, and
when this happens proc_do_cad_pid() will increment the refcount on the
new pid via get_pid(), and will decrement the refcount on the old pid
via put_pid(). As we never called get_pid() when we initialized
`cad_pid`, we decrement a reference we never incremented, can therefore
free the init task's struct pid early. As there can be dangling
references to the struct pid, we can later encounter a use-after-free
(e.g. when delivering signals).
This was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to
have been around since the conversion of `cad_pid` to struct pid in
commit 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid") from the
pre-KASAN stone age of v2.6.19.
Fix this by getting a reference to the init task's struct pid when we
assign it to `cad_pid`.
Full KASAN splat below.
BUG: KASAN: use-after-free in ns_of_pid include/linux/pid.h:153 [inline]
BUG: KASAN: use-after-free in task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509
Read of size 4 at addr ffff23794dda0004 by task syz-executor.0/273
CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1
Hardware name: linux,dummy-virt (DT)
Call trace:
ns_of_pid include/linux/pid.h:153 [inline]
task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509
do_notify_parent+0x308/0xe60 kernel/signal.c:1950
exit_notify kernel/exit.c:682 [inline]
do_exit+0x2334/0x2bd0 kernel/exit.c:845
do_group_exit+0x108/0x2c8 kernel/exit.c:922
get_signal+0x4e4/0x2a88 kernel/signal.c:2781
do_signal arch/arm64/kernel/signal.c:882 [inline]
do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936
work_pending+0xc/0x2dc
Allocated by task 0:
slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516
slab_alloc_node mm/slub.c:2907 [inline]
slab_alloc mm/slub.c:2915 [inline]
kmem
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.46-1 (bookworm) | linux 5.10.46-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 < 764c2e892d1fe895392aff62fb353fdce43bb529 | 764c2e892d1fe895392aff62fb353fdce43bb529 |
| linux | linux | >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 < f86c80515a8a3703e0ca2e56deb50fc2879c5ea4 | f86c80515a8a3703e0ca2e56deb50fc2879c5ea4 |
| linux | linux | >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 < 4dbd8808a591b49b717862e6e0081bcf14a87788 | 4dbd8808a591b49b717862e6e0081bcf14a87788 |
| linux | linux | >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 < d106f05432e60f9f62d456ef017687f5c73cb414 | d106f05432e60f9f62d456ef017687f5c73cb414 |
| linux | linux | >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 < 2cd6eedfa6344f5ef5c3dac3aee57a39b5b46dff | 2cd6eedfa6344f5ef5c3dac3aee57a39b5b46dff |
| linux | linux | >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 < 7178be006d495ffb741c329012da289b62dddfe6 | 7178be006d495ffb741c329012da289b62dddfe6 |
| linux | linux | >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 < b8ff869f20152fbe66b6c2e2715d26a2f9897cca | b8ff869f20152fbe66b6c2e2715d26a2f9897cca |
| linux | linux | >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 < 0711f0d7050b9e07c44bc159bbc64ac0a1022c7f | 0711f0d7050b9e07c44bc159bbc64ac0a1022c7f |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 4.4.0-262.296 | 4.4.0-262.296 |
| linux | linux_kernel | >= 2.6.19 < 4.4.272 | 4.4.272 |
| linux | linux_kernel | >= 4.10 < 4.14.236 | 4.14.236 |
| linux | linux_kernel | >= 4.15 < 4.19.194 | 4.19.194 |
| linux | linux_kernel | >= 4.20 < 5.4.125 | 5.4.125 |
| linux | linux_kernel | >= 4.5 < 4.9.272 | 4.9.272 |
| linux | linux_kernel | >= 5.11 < 5.12.10 | 5.12.10 |
| linux | linux_kernel | >= 5.5 < 5.10.43 | 5.10.43 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-01-06·CVSS 5.5
CVE-2024-35886 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux
kernel contained an integer overflow vulnerability. A local attacker could
use this to cause a denial of service (system crash). (CVE-2022-36402)
Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver
in the Linux kernel during device removal. A privileged attacker could use
this to cause a denial of service (system crash). (CVE-2023-35827)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- I2C subsystem;
- Network drivers;
- Pin controllers subsyste
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-01-06·CVSS 8.8
CVE-2024-53057 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux
kernel contained a type-confusion error. A physically proximate remote
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-12351)
Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux
kernel did not properly initialize memory in some situations. A physically
proximate remote attacker could use this to expose sensitive information
(kernel memory). (CVE-2020-12352)
Andy Nguyen discovered that the Bluetooth HCI event packet parser in the
Linux kernel did not properly handle event advertisements of certain sizes,
leading to a heap-bas
Red Hat
kernel: pid: take a reference when initializing `cad_pid`
vendor_redhat·2024-03-15·CVSS 7.8
CVE-2021-47118 [HIGH] CWE-416 kernel: pid: take a reference when initializing `cad_pid`
kernel: pid: take a reference when initializing `cad_pid`
In the Linux kernel, the following vulnerability has been resolved:
pid: take a reference when initializing `cad_pid`
During boot, kernel_init_freeable() initializes `cad_pid` to the init
task's struct pid. Later on, we may change `cad_pid` via a sysctl, and
when this happens proc_do_cad_pid() will increment the refcount on the
new pid via get_pid(), and will decrement the refcount on the old pid
via put_pid(). As we never called get_pid() when we initialized
`cad_pid`, we decrement a reference we never incremented, can therefore
free the init task's struct pid early. As there can be dangling
references to the struct pid, we can later encounter a use-after-free
(e.g. when delivering signals).
This was spotted when fuzzing v5.13-rc3
Debian
CVE-2021-47118: linux - In the Linux kernel, the following vulnerability has been resolved: pid: take a...
vendor_debian·2021·CVSS 7.8
CVE-2021-47118 [HIGH] CVE-2021-47118: linux - In the Linux kernel, the following vulnerability has been resolved: pid: take a...
In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when initializing `cad_pid` During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will increment the refcount on the new pid via get_pid(), and will decrement the refcount on the old pid via put_pid(). As we never called get_pid() when we initialized `cad_pid`, we decrement a reference we never incremented, can therefore free the init task's struct pid early. As there can be dangling references to the struct pid, we can later encounter a use-after-free (e.g. when delivering signals). This was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to have been around since the co
OSV
linux, linux-lts-xenial vulnerabilities
osv·2025-01-06·CVSS 8.8
CVE-2020-12351 [HIGH] linux, linux-lts-xenial vulnerabilities
linux, linux-lts-xenial vulnerabilities
Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux
kernel contained a type-confusion error. A physically proximate remote
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-12351)
Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux
kernel did not properly initialize memory in some situations. A physically
proximate remote attacker could use this to expose sensitive information
(kernel memory). (CVE-2020-12352)
Andy Nguyen discovered that the Bluetooth HCI event packet parser in the
Linux kernel did not properly handle event advertisements of certain sizes,
leading to a heap-based buffer overflow. A physically proximate remote
attacker cou
OSV
linux-aws, linux-kvm vulnerabilities
osv·2025-01-06·CVSS 5.5
CVE-2022-36402 [MEDIUM] linux-aws, linux-kvm vulnerabilities
linux-aws, linux-kvm vulnerabilities
Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux
kernel contained an integer overflow vulnerability. A local attacker could
use this to cause a denial of service (system crash). (CVE-2022-36402)
Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver
in the Linux kernel during device removal. A privileged attacker could use
this to cause a denial of service (system crash). (CVE-2023-35827)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- I2C subsystem;
- Network drivers;
- Pin controllers subsystem;
- TTY drivers;
- USB Mass Storage drivers;
- Framebuffer layer
GHSA
GHSA-f22j-p6f5-7h8x: In the Linux kernel, the following vulnerability has been resolved:
pid: take a reference when initializing `cad_pid`
During boot, kernel_init_freea
ghsa_unreviewed·2024-03-15
CVE-2021-47118 [HIGH] CWE-416 GHSA-f22j-p6f5-7h8x: In the Linux kernel, the following vulnerability has been resolved:
pid: take a reference when initializing `cad_pid`
During boot, kernel_init_freea
In the Linux kernel, the following vulnerability has been resolved:
pid: take a reference when initializing `cad_pid`
During boot, kernel_init_freeable() initializes `cad_pid` to the init
task's struct pid. Later on, we may change `cad_pid` via a sysctl, and
when this happens proc_do_cad_pid() will increment the refcount on the
new pid via get_pid(), and will decrement the refcount on the old pid
via put_pid(). As we never called get_pid() when we initialized
`cad_pid`, we decrement a reference we never incremented, can therefore
free the init task's struct pid early. As there can be dangling
references to the struct pid, we can later encounter a use-after-free
(e.g. when delivering signals).
This was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to
have been around since the
OSV
CVE-2021-47118: In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when initializing `cad_pid` During boot, kernel_init_freeabl
osv·2024-03-15·CVSS 7.8
CVE-2021-47118 [HIGH] CVE-2021-47118: In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when initializing `cad_pid` During boot, kernel_init_freeabl
In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when initializing `cad_pid` During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will increment the refcount on the new pid via get_pid(), and will decrement the refcount on the old pid via put_pid(). As we never called get_pid() when we initialized `cad_pid`, we decrement a reference we never incremented, can therefore free the init task's struct pid early. As there can be dangling references to the struct pid, we can later encounter a use-after-free (e.g. when delivering signals). This was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to have been around since the co
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0711f0d7050b9e07c44bc159bbc64ac0a1022c7fhttps://git.kernel.org/stable/c/2cd6eedfa6344f5ef5c3dac3aee57a39b5b46dffhttps://git.kernel.org/stable/c/4dbd8808a591b49b717862e6e0081bcf14a87788https://git.kernel.org/stable/c/7178be006d495ffb741c329012da289b62dddfe6https://git.kernel.org/stable/c/764c2e892d1fe895392aff62fb353fdce43bb529https://git.kernel.org/stable/c/b8ff869f20152fbe66b6c2e2715d26a2f9897ccahttps://git.kernel.org/stable/c/d106f05432e60f9f62d456ef017687f5c73cb414https://git.kernel.org/stable/c/f86c80515a8a3703e0ca2e56deb50fc2879c5ea4https://git.kernel.org/stable/c/0711f0d7050b9e07c44bc159bbc64ac0a1022c7fhttps://git.kernel.org/stable/c/2cd6eedfa6344f5ef5c3dac3aee57a39b5b46dffhttps://git.kernel.org/stable/c/4dbd8808a591b49b717862e6e0081bcf14a87788https://git.kernel.org/stable/c/7178be006d495ffb741c329012da289b62dddfe6https://git.kernel.org/stable/c/764c2e892d1fe895392aff62fb353fdce43bb529https://git.kernel.org/stable/c/b8ff869f20152fbe66b6c2e2715d26a2f9897ccahttps://git.kernel.org/stable/c/d106f05432e60f9f62d456ef017687f5c73cb414https://git.kernel.org/stable/c/f86c80515a8a3703e0ca2e56deb50fc2879c5ea4
2024-03-15
Published