CVE-2021-47375
published 2024-05-21CVE-2021-47375: In the Linux kernel, the following vulnerability has been resolved: blktrace: Fix uaf in blk_trace access after removing by sysfs There is an use-after-free…
PriorityP425medium6.2CVSS 3.1
AVLACLPRNUINSUCHINAN
EPSS
0.25%
16.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
blktrace: Fix uaf in blk_trace access after removing by sysfs
There is an use-after-free problem triggered by following process:
P1(sda) P2(sdb)
echo 0 > /sys/block/sdb/trace/enable
blk_trace_remove_queue
synchronize_rcu
blk_trace_free
relay_close
rcu_read_lock
__blk_add_trace
trace_note_tsk
(Iterate running_trace_list)
relay_close_buf
relay_destroy_buf
kfree(buf)
trace_note(sdb's bt)
relay_reserve
buf->offset /sys/block/sdb/trace/enable &
// Add delay(mdelay/msleep) before kernel enters blk_trace_free()
ioctl$SG_IO(/dev/sda, SG_IO, ...)
// Enters trace_note_tsk() after blk_trace_free() returned
// Use mdelay in rcu region rather than msleep(which may schedule out)
Remove blk_trace from running_list before calling blk_trace_free() by
sysfs if blk_trace is at Blktrace_running state.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.14.9-1 (bookworm) | linux 5.14.9-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= c71a896154119f4ca9e89d6078f5f63ad60ef199 < 488da313edf3abea7f7733efe011c96b23740ab5 | 488da313edf3abea7f7733efe011c96b23740ab5 |
| linux | linux | >= c71a896154119f4ca9e89d6078f5f63ad60ef199 < dacfd5e4d1142bfb3809aab3634a375f6f373269 | dacfd5e4d1142bfb3809aab3634a375f6f373269 |
| linux | linux | >= c71a896154119f4ca9e89d6078f5f63ad60ef199 < d56171d9360c0170c5c5f8f7e2362a2e999eca40 | d56171d9360c0170c5c5f8f7e2362a2e999eca40 |
| linux | linux | >= c71a896154119f4ca9e89d6078f5f63ad60ef199 < 677e362ba807f3aafe6f405c07e0b37244da5222 | 677e362ba807f3aafe6f405c07e0b37244da5222 |
| linux | linux | >= c71a896154119f4ca9e89d6078f5f63ad60ef199 < ebb8d26d93c3ec3c7576c52a8373a2309423c069 | ebb8d26d93c3ec3c7576c52a8373a2309423c069 |
| linux | linux | >= c71a896154119f4ca9e89d6078f5f63ad60ef199 < 3815fe7371d2411ce164281cef40d9fc7b323dee | 3815fe7371d2411ce164281cef40d9fc7b323dee |
| linux | linux | >= c71a896154119f4ca9e89d6078f5f63ad60ef199 < a5f8e86192612d0183047448d8bbe7918b3f1a26 | a5f8e86192612d0183047448d8bbe7918b3f1a26 |
| linux | linux | >= c71a896154119f4ca9e89d6078f5f63ad60ef199 < 5afedf670caf30a2b5a52da96eb7eac7dee6a9c9 | 5afedf670caf30a2b5a52da96eb7eac7dee6a9c9 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.70-1 | 5.10.70-1 |
| linux | linux_kernel | >= 0 < 5.14.9-1 | 5.14.9-1 |
| linux | linux_kernel | >= 0 < 5.14.9-1 | 5.14.9-1 |
| linux | linux_kernel | >= 0 < 5.14.9-1 | 5.14.9-1 |
| linux | linux_kernel | >= 2.6.30 < 4.4.286 | 4.4.286 |
| linux | linux_kernel | >= 4.10 < 4.14.249 | 4.14.249 |
| linux | linux_kernel | >= 4.15 < 4.19.209 | 4.19.209 |
| linux | linux_kernel | >= 4.20 < 5.4.150 | 5.4.150 |
| linux | linux_kernel | >= 4.5 < 4.9.285 | 4.9.285 |
| linux | linux_kernel | >= 5.11 < 5.14.9 | 5.14.9 |
| linux | linux_kernel | >= 5.5 < 5.10.70 | 5.10.70 |
CVSS provenance
nvdv3.16.2MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv6.2MEDIUM
vendor_debian6.2MEDIUM
vendor_redhat6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: blktrace: Fix uaf in blk_trace access after removing by sysfs
vendor_redhat·2024-05-21·CVSS 6.2
CVE-2021-47375 [MEDIUM] CWE-416 kernel: blktrace: Fix uaf in blk_trace access after removing by sysfs
kernel: blktrace: Fix uaf in blk_trace access after removing by sysfs
In the Linux kernel, the following vulnerability has been resolved:
blktrace: Fix uaf in blk_trace access after removing by sysfs
There is an use-after-free problem triggered by following process:
P1(sda)P2(sdb)
echo 0 > /sys/block/sdb/trace/enable
blk_trace_remove_queue
synchronize_rcu
blk_trace_free
relay_close
rcu_read_lock
__blk_add_trace
trace_note_tsk
(Iterate running_trace_list)
relay_close_buf
relay_destroy_buf
kfree(buf)
trace_note(sdb's bt)
relay_reserve
buf->offset /sys/block/sdb/trace/enable &
// Add delay(mdelay/msleep) before kernel enters blk_trace_free()
ioctl$SG_IO(/dev/sda, SG_IO, ...)
// Enters trace_note_tsk() after blk_trace_free() returned
// Use mdelay in rcu region rather than msleep(which may sc
Debian
CVE-2021-47375: linux - In the Linux kernel, the following vulnerability has been resolved: blktrace: F...
vendor_debian·2021·CVSS 6.2
CVE-2021-47375 [MEDIUM] CVE-2021-47375: linux - In the Linux kernel, the following vulnerability has been resolved: blktrace: F...
In the Linux kernel, the following vulnerability has been resolved: blktrace: Fix uaf in blk_trace access after removing by sysfs There is an use-after-free problem triggered by following process: P1(sda) P2(sdb) echo 0 > /sys/block/sdb/trace/enable blk_trace_remove_queue synchronize_rcu blk_trace_free relay_close rcu_read_lock __blk_add_trace trace_note_tsk (Iterate running_trace_list) relay_close_buf relay_destroy_buf kfree(buf) trace_note(sdb's bt) relay_reserve buf->offset /sys/block/sdb/trace/enable & // Add delay(mdelay/msleep) before kernel enters blk_trace_free() ioctl$SG_IO(/dev/sda, SG_IO, ...) // Enters trace_note_tsk() after blk_trace_free() returned // Use mdelay in rcu region rather than msleep(which may schedule out) Remove blk_trace from running_list before calling blk_trac
OSV
CVE-2021-47375: In the Linux kernel, the following vulnerability has been resolved: blktrace: Fix uaf in blk_trace access after removing by sysfs There is an use-afte
osv·2024-05-21·CVSS 6.2
CVE-2021-47375 [MEDIUM] CVE-2021-47375: In the Linux kernel, the following vulnerability has been resolved: blktrace: Fix uaf in blk_trace access after removing by sysfs There is an use-afte
In the Linux kernel, the following vulnerability has been resolved: blktrace: Fix uaf in blk_trace access after removing by sysfs There is an use-after-free problem triggered by following process: P1(sda) P2(sdb) echo 0 > /sys/block/sdb/trace/enable blk_trace_remove_queue synchronize_rcu blk_trace_free relay_close rcu_read_lock __blk_add_trace trace_note_tsk (Iterate running_trace_list) relay_close_buf relay_destroy_buf kfree(buf) trace_note(sdb's bt) relay_reserve buf->offset /sys/block/sdb/trace/enable & // Add delay(mdelay/msleep) before kernel enters blk_trace_free() ioctl$SG_IO(/dev/sda, SG_IO, ...) // Enters trace_note_tsk() after blk_trace_free() returned // Use mdelay in rcu region rather than msleep(which may schedule out) Remove blk_trace from running_list before calling blk_trac
GHSA
GHSA-x6vg-gvf6-hmp9: In the Linux kernel, the following vulnerability has been resolved:
blktrace: Fix uaf in blk_trace access after removing by sysfs
There is an use-af
ghsa_unreviewed·2024-05-21
CVE-2021-47375 [MEDIUM] CWE-416 GHSA-x6vg-gvf6-hmp9: In the Linux kernel, the following vulnerability has been resolved:
blktrace: Fix uaf in blk_trace access after removing by sysfs
There is an use-af
In the Linux kernel, the following vulnerability has been resolved:
blktrace: Fix uaf in blk_trace access after removing by sysfs
There is an use-after-free problem triggered by following process:
P1(sda) P2(sdb)
echo 0 > /sys/block/sdb/trace/enable
blk_trace_remove_queue
synchronize_rcu
blk_trace_free
relay_close
rcu_read_lock
__blk_add_trace
trace_note_tsk
(Iterate running_trace_list)
relay_close_buf
relay_destroy_buf
kfree(buf)
trace_note(sdb's bt)
relay_reserve
buf->offset /sys/block/sdb/trace/enable &
// Add delay(mdelay/msleep) before kernel enters blk_trace_free()
ioctl$SG_IO(/dev/sda, SG_IO, ...)
// Enters trace_note_tsk() after blk_trace_free() returned
// Use mdelay in rcu region rather than msleep(which may schedule out)
Remove blk_trace from running_list before calling blk
No detection rules found.
No public exploits indexed.
arXiv
SyzParam: Introducing Runtime Parameters into Kernel Driver Fuzzing
arxiv_fulltext·2025-01-17
SyzParam: Introducing Runtime Parameters into Kernel Driver Fuzzing
: Incorporating Runtime Parameters into Kernel Driver Fuzzing
Yue Sun
SKLP, Institute of Computing Technology, CAS & University of Chinese Academy of Sciences
Beijing
China
[email protected]
Yan Kang
SKLP, Institute of Computing Technology, CAS & University of Chinese Academy of Sciences
Beijing
China
[email protected]
Chenggang Wu
Corresponding author.
SKLP, Institute of Computing Technology, CAS & University of Chinese Academy of Sciences & Zhongguancun Laboratory
Beijing
China
[email protected]
Kangjie Lu
University of Minnesota
Minneapolis
USA
[email protected]
Jiming Wang
SKLP, Institute of Computing Technology, CAS & University of Chinese Academy of Sciences
Beijing
China
[email protected]
Xingwei Li
Information Engineering University
Beijing
China
xrivendell7@out
Bugzilla
CVE-2021-47375 kernel: blktrace: Fix uaf in blk_trace access after removing by sysfs
bugzilla·2024-05-22·CVSS 6.2
CVE-2021-47375 [MEDIUM] CVE-2021-47375 kernel: blktrace: Fix uaf in blk_trace access after removing by sysfs
CVE-2021-47375 kernel: blktrace: Fix uaf in blk_trace access after removing by sysfs
In the Linux kernel, the following vulnerability has been resolved:
blktrace: Fix uaf in blk_trace access after removing by sysfs
The Linux kernel CVE team has assigned CVE-2021-47375 to this issue.
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024052141-CVE-2021-47375-8849@gregkh/T
Discussion:
The result of automatic check (that is developed by Alexander Larkin) for this CVE-2021-47375 is: CHECK Maybe valid. Check manually. with impact MODERATE (that is an approximation based on flags LOCK NULLPTR INIT TRACE UAF ; these flags parsed automatically based on patch data). Such automatic check happens only for Low/Moderates (and only when not from reporter, but parsing already existing C
https://git.kernel.org/stable/c/3815fe7371d2411ce164281cef40d9fc7b323deehttps://git.kernel.org/stable/c/488da313edf3abea7f7733efe011c96b23740ab5https://git.kernel.org/stable/c/5afedf670caf30a2b5a52da96eb7eac7dee6a9c9https://git.kernel.org/stable/c/677e362ba807f3aafe6f405c07e0b37244da5222https://git.kernel.org/stable/c/a5f8e86192612d0183047448d8bbe7918b3f1a26https://git.kernel.org/stable/c/d56171d9360c0170c5c5f8f7e2362a2e999eca40https://git.kernel.org/stable/c/dacfd5e4d1142bfb3809aab3634a375f6f373269https://git.kernel.org/stable/c/ebb8d26d93c3ec3c7576c52a8373a2309423c069https://git.kernel.org/stable/c/3815fe7371d2411ce164281cef40d9fc7b323deehttps://git.kernel.org/stable/c/488da313edf3abea7f7733efe011c96b23740ab5https://git.kernel.org/stable/c/5afedf670caf30a2b5a52da96eb7eac7dee6a9c9https://git.kernel.org/stable/c/677e362ba807f3aafe6f405c07e0b37244da5222https://git.kernel.org/stable/c/a5f8e86192612d0183047448d8bbe7918b3f1a26https://git.kernel.org/stable/c/d56171d9360c0170c5c5f8f7e2362a2e999eca40https://git.kernel.org/stable/c/dacfd5e4d1142bfb3809aab3634a375f6f373269https://git.kernel.org/stable/c/ebb8d26d93c3ec3c7576c52a8373a2309423c069
2024-05-21
Published