CVE-2021-47376

published 2024-05-21

CVE-2021-47376: In the Linux kernel, the following vulnerability has been resolved: bpf: Add oversize check before call kvcalloc() Commit 7661809d493b ("mm: don't allow…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

bpf: Add oversize check before call kvcalloc()

Commit 7661809d493b ("mm: don't allow oversized kvmalloc() calls") add the
oversize check. When the allocation is larger than what kmalloc() supports,
the following warning triggered:

WARNING: CPU: 0 PID: 8408 at mm/util.c:597 kvmalloc_node+0x108/0x110 mm/util.c:597
Modules linked in:
CPU: 0 PID: 8408 Comm: syz-executor221 Not tainted 5.14.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:kvmalloc_node+0x108/0x110 mm/util.c:597
Call Trace:
kvmalloc include/linux/mm.h:806 [inline]
kvmalloc_array include/linux/mm.h:824 [inline]
kvcalloc include/linux/mm.h:829 [inline]
check_btf_line kernel/bpf/verifier.c:9925 [inline]
check_btf_info kernel/bpf/verifier.c:10049 [inline]
bpf_check+0xd634/0x150d0 kernel/bpf/verifier.c:13759
bpf_prog_load kernel/bpf/syscall.c:2301 [inline]
__sys_bpf+0x11181/0x126e0 kernel/bpf/syscall.c:4587
__do_sys_bpf kernel/bpf/syscall.c:4691 [inline]
__se_sys_bpf kernel/bpf/syscall.c:4689 [inline]
__x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4689
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.14.9-1 (bookworm)	linux 5.14.9-1 (bookworm)
linux	linux	—	—
linux	linux	>= c454a46b5efd8eff8880e88ece2976e60a26bf35 < 93937596e0652d50973f9dc944fea1694ac8cdfd	93937596e0652d50973f9dc944fea1694ac8cdfd
linux	linux	>= c454a46b5efd8eff8880e88ece2976e60a26bf35 < 6345a0bee80139ea00a341c4202ebfd1534b5eb0	6345a0bee80139ea00a341c4202ebfd1534b5eb0
linux	linux	>= c454a46b5efd8eff8880e88ece2976e60a26bf35 < b5fe7cdfee5901ce5513c30e554d51536e003bde	b5fe7cdfee5901ce5513c30e554d51536e003bde
linux	linux	>= c454a46b5efd8eff8880e88ece2976e60a26bf35 < 0e6491b559704da720f6da09dd0a52c4df44c514	0e6491b559704da720f6da09dd0a52c4df44c514
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.70-1	5.10.70-1
linux	linux_kernel	>= 0 < 5.14.9-1	5.14.9-1
linux	linux_kernel	>= 0 < 5.14.9-1	5.14.9-1
linux	linux_kernel	>= 0 < 5.14.9-1	5.14.9-1
linux	linux_kernel	>= 5.0 < 5.4.150	5.4.150
linux	linux_kernel	>= 5.11 < 5.14.9	5.14.9
linux	linux_kernel	>= 5.5 < 5.10.70	5.10.70

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.