CVE-2021-47402
published 2024-05-21CVE-2021-47402: In the Linux kernel, the following vulnerability has been resolved: net: sched: flower: protect fl_walk() with rcu Patch that refactored fl_walk() to use…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.24%
15.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: sched: flower: protect fl_walk() with rcu
Patch that refactored fl_walk() to use idr_for_each_entry_continue_ul()
also removed rcu protection of individual filters which causes following
use-after-free when filter is deleted concurrently. Fix fl_walk() to obtain
rcu read lock while iterating and taking the filter reference and temporary
release the lock while calling arg->fn() callback that can sleep.
KASAN trace:
[ 352.773640] ==================================================================
[ 352.775041] BUG: KASAN: use-after-free in fl_walk+0x159/0x240 [cls_flower]
[ 352.776304] Read of size 4 at addr ffff8881c8251480 by task tc/2987
[ 352.777862] CPU: 3 PID: 2987 Comm: tc Not tainted 5.15.0-rc2+ #2
[ 352.778980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[ 352.781022] Call Trace:
[ 352.781573] dump_stack_lvl+0x46/0x5a
[ 352.782332] print_address_description.constprop.0+0x1f/0x140
[ 352.783400] ? fl_walk+0x159/0x240 [cls_flower]
[ 352.784292] ? fl_walk+0x159/0x240 [cls_flower]
[ 352.785138] kasan_report.cold+0x83/0xdf
[ 352.785851] ? fl_walk+0x159/0x240 [cls_flower]
[ 352.786587] kasan_check_range+0x145/0x1a0
[ 352.787337] fl_walk+0x159/0x240 [cls_flower]
[ 352.788163] ? fl_put+0x10/0x10 [cls_flower]
[ 352.789007] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220
[ 352.790102] tcf_chain_dump+0x231/0x450
[ 352.790878] ? tcf_chain_tp_delete_empty+0x170/0x170
[ 352.791833] ? __might_sleep+0x2e/0xc0
[ 352.792594] ? tfilter_notify+0x170/0x170
[ 352.793400] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220
[ 352.794477] tc_dump_tfilter+0x385/0x4b0
[ 352.795262] ? tc_new_tfilter+0x1180/0x1180
[ 352.796103] ? __mod_node_page_state+0x1f/0xc0
[ 352.796974] ? __build_skb_around+0x10e/0x130
[ 352.797826] netlink_dump+0x2c0/0x560
[ 352.798563] ? netlink_getsockopt+0x430/0x430
[ 352.799433] ? __mutex_unlock_slowpath.constprop.0+0x
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.14.12-1 (bookworm) | linux 5.14.12-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= d39d714969cda5cbda291402c8c6b1fb1047f42e < 694b0cee7f8546b69a80996a29cb3cf4149c0453 | 694b0cee7f8546b69a80996a29cb3cf4149c0453 |
| linux | linux | >= d39d714969cda5cbda291402c8c6b1fb1047f42e < d0d520c19e7ea19ed38dc5797b12397b6ccf9f88 | d0d520c19e7ea19ed38dc5797b12397b6ccf9f88 |
| linux | linux | >= d39d714969cda5cbda291402c8c6b1fb1047f42e < dab4677bdbffa5c8270e79e34e51c89efa0728a0 | dab4677bdbffa5c8270e79e34e51c89efa0728a0 |
| linux | linux | >= d39d714969cda5cbda291402c8c6b1fb1047f42e < d5ef190693a7d76c5c192d108e8dec48307b46ee | d5ef190693a7d76c5c192d108e8dec48307b46ee |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.84-1 | 5.10.84-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 5.11 < 5.14.10 | 5.14.10 |
| linux | linux_kernel | >= 5.3 < 5.4.151 | 5.4.151 |
| linux | linux_kernel | >= 5.5 < 5.10.71 | 5.10.71 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xwvh-fxhh-3qrr: In the Linux kernel, the following vulnerability has been resolved:
net: sched: flower: protect fl_walk() with rcu
Patch that refactored fl_walk() t
ghsa_unreviewed·2024-05-21
CVE-2021-47402 [HIGH] CWE-416 GHSA-xwvh-fxhh-3qrr: In the Linux kernel, the following vulnerability has been resolved:
net: sched: flower: protect fl_walk() with rcu
Patch that refactored fl_walk() t
In the Linux kernel, the following vulnerability has been resolved:
net: sched: flower: protect fl_walk() with rcu
Patch that refactored fl_walk() to use idr_for_each_entry_continue_ul()
also removed rcu protection of individual filters which causes following
use-after-free when filter is deleted concurrently. Fix fl_walk() to obtain
rcu read lock while iterating and taking the filter reference and temporary
release the lock while calling arg->fn() callback that can sleep.
KASAN trace:
[ 352.773640] ==================================================================
[ 352.775041] BUG: KASAN: use-after-free in fl_walk+0x159/0x240 [cls_flower]
[ 352.776304] Read of size 4 at addr ffff8881c8251480 by task tc/2987
[ 352.777862] CPU: 3 PID: 2987 Comm: tc Not tainted 5.15.0-rc2+ #2
[ 352.778
OSV
CVE-2021-47402: In the Linux kernel, the following vulnerability has been resolved: net: sched: flower: protect fl_walk() with rcu Patch that refactored fl_walk() to
osv·2024-05-21·CVSS 7.8
CVE-2021-47402 [HIGH] CVE-2021-47402: In the Linux kernel, the following vulnerability has been resolved: net: sched: flower: protect fl_walk() with rcu Patch that refactored fl_walk() to
In the Linux kernel, the following vulnerability has been resolved: net: sched: flower: protect fl_walk() with rcu Patch that refactored fl_walk() to use idr_for_each_entry_continue_ul() also removed rcu protection of individual filters which causes following use-after-free when filter is deleted concurrently. Fix fl_walk() to obtain rcu read lock while iterating and taking the filter reference and temporary release the lock while calling arg->fn() callback that can sleep. KASAN trace: [ 352.773640] ================================================================== [ 352.775041] BUG: KASAN: use-after-free in fl_walk+0x159/0x240 [cls_flower] [ 352.776304] Read of size 4 at addr ffff8881c8251480 by task tc/2987 [ 352.777862] CPU: 3 PID: 2987 Comm: tc Not tainted 5.15.0-rc2+ #2 [ 352.778980]
Red Hat
kernel: net: sched: flower: protect fl_walk() with rcu
vendor_redhat·2024-05-21·CVSS 7.8
CVE-2021-47402 [HIGH] CWE-416 kernel: net: sched: flower: protect fl_walk() with rcu
kernel: net: sched: flower: protect fl_walk() with rcu
In the Linux kernel, the following vulnerability has been resolved:
net: sched: flower: protect fl_walk() with rcu
Patch that refactored fl_walk() to use idr_for_each_entry_continue_ul()
also removed rcu protection of individual filters which causes following
use-after-free when filter is deleted concurrently. Fix fl_walk() to obtain
rcu read lock while iterating and taking the filter reference and temporary
release the lock while calling arg->fn() callback that can sleep.
KASAN trace:
[ 352.773640] ==================================================================
[ 352.775041] BUG: KASAN: use-after-free in fl_walk+0x159/0x240 [cls_flower]
[ 352.776304] Read of size 4 at addr ffff8881c8251480 by task tc/2987
[ 352.777862] CPU: 3 PID:
Debian
CVE-2021-47402: linux - In the Linux kernel, the following vulnerability has been resolved: net: sched:...
vendor_debian·2021·CVSS 7.8
CVE-2021-47402 [HIGH] CVE-2021-47402: linux - In the Linux kernel, the following vulnerability has been resolved: net: sched:...
In the Linux kernel, the following vulnerability has been resolved: net: sched: flower: protect fl_walk() with rcu Patch that refactored fl_walk() to use idr_for_each_entry_continue_ul() also removed rcu protection of individual filters which causes following use-after-free when filter is deleted concurrently. Fix fl_walk() to obtain rcu read lock while iterating and taking the filter reference and temporary release the lock while calling arg->fn() callback that can sleep. KASAN trace: [ 352.773640] ================================================================== [ 352.775041] BUG: KASAN: use-after-free in fl_walk+0x159/0x240 [cls_flower] [ 352.776304] Read of size 4 at addr ffff8881c8251480 by task tc/2987 [ 352.777862] CPU: 3 PID: 2987 Comm: tc Not tainted 5.15.0-rc2+ #2 [ 352.778980]
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/694b0cee7f8546b69a80996a29cb3cf4149c0453https://git.kernel.org/stable/c/d0d520c19e7ea19ed38dc5797b12397b6ccf9f88https://git.kernel.org/stable/c/d5ef190693a7d76c5c192d108e8dec48307b46eehttps://git.kernel.org/stable/c/dab4677bdbffa5c8270e79e34e51c89efa0728a0https://git.kernel.org/stable/c/694b0cee7f8546b69a80996a29cb3cf4149c0453https://git.kernel.org/stable/c/d0d520c19e7ea19ed38dc5797b12397b6ccf9f88https://git.kernel.org/stable/c/d5ef190693a7d76c5c192d108e8dec48307b46eehttps://git.kernel.org/stable/c/dab4677bdbffa5c8270e79e34e51c89efa0728a0
2024-05-21
Published