CVE-2021-47128: In the Linux kernel, the following vulnerability has been resolved: bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks Commit 59438b46471a…

PriorityP421medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.18%

7.3th percentile

In the Linux kernel, the following vulnerability has been resolved: bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks Commit 59438b46471a ("security,lockdown,selinux: implement SELinux lockdown") added an implementation of the locked_down LSM hook to SELinux, with the aim to restrict which domains are allowed to perform operations that would breach lockdown. This is indirectly also getting audit subsystem involved to report events. The latter is problematic, as reported by Ondrej and Serhei, since it can bring down the whole system via audit: 1) The audit events that are triggered due to calls to security_locked_down() can OOM kill a machine, see below details [0]. 2) It also seems to be causing a deadlock via avc_has_perm()/slow_avc_audit() when trying to wake up kauditd, for example, when using trace_sched_switch() tracepoint, see details in [1]. Triggering this was not via some hypothetical corner case, but with existing tools like runqlat & runqslower from bcc, for example, which make use of this tracepoint. Rough call sequence goes like: rq_lock(rq) -> -------------------------+ trace_sched_switch() -> | bpf_prog_xyz() -> +-> deadlock selinux_lockdown() -> | audit_log_end() -> | wake_up_interruptible() -> | try_to_wake_up() -> | rq_lock(rq) --------------+ What's worse is that the intention of 59438b46471a to further restrict lockdown settings for specific applications in respect to the global lockdown policy is completely broken for BPF. The SELinux policy rule for the current lockdown check looks something like this: allow : lockdown { }; However, this doesn't match with the 'current' task where the security_locked_down() is executed, example: httpd does a syscall. There is a tracing program attached to the syscall which triggers a BPF program to run, which ends up doing a bpf_probe_read_kernel{,_str}() helper call. The selinux_lockdown() hook does the permission check against 'current', that is, httpd in this example. httpd has liter

Affected

12 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.10.46-1 (bookworm)	linux 5.10.46-1 (bookworm)
linux	linux	—	—
linux	linux	>= 59438b46471ae6cdfb761afc8c9beaf1e428a331 < ff5039ec75c83d2ed5b781dc7733420ee8c985fc	ff5039ec75c83d2ed5b781dc7733420ee8c985fc
linux	linux	>= 59438b46471ae6cdfb761afc8c9beaf1e428a331 < acc43fc6cf0d50612193813c5906a1ab9d433e1e	acc43fc6cf0d50612193813c5906a1ab9d433e1e
linux	linux	>= 59438b46471ae6cdfb761afc8c9beaf1e428a331 < ff40e51043af63715ab413995ff46996ecf9583f	ff40e51043af63715ab413995ff46996ecf9583f
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.46-1	5.10.46-1
linux	linux_kernel	>= 0 < 5.10.46-1	5.10.46-1
linux	linux_kernel	>= 0 < 5.10.46-1	5.10.46-1
linux	linux_kernel	>= 0 < 5.10.46-1	5.10.46-1
linux	linux_kernel	>= 5.11 < 5.12.10	5.12.10
linux	linux_kernel	>= 5.6 < 5.10.43	5.10.43

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian5.5MEDIUM

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.