CVE-2021-46984: kyber: fix out of bounds access when preempted
In the Linux kernel, the following vulnerability has been resolved:
kyber: fix out of bounds access when preempted
blkmqschedbiomerge() gets the ctx and hctx for the current CPU and passes the hctx to ->biomerge(). kyberbiomerge() then gets the ctx for the current CPU again and uses that to get the corresponding Kyber context in the passed hctx. However, the thread may be preempted between the two calls to blkmqgetctx(), and the ctx returned the second time may no longer correspond to the passed hctx. This "works" accidentally most of the time, but it can cause us to read garbage if the second ctx came from an hctx with more ctx's than the first one (i.e., if ctx->indexhw[hctx->type] > hctx->nrctx).
This manifested as this UBSAN array index out of bounds error reported by Jakub:
UBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9 index 13106 is out of range for type 'long unsigned int [128]' Call Trace: dumpstack+0xa4/0xe5 ubsanepilogue+0x5/0x40 ubsanhandleoutofbounds.cold.13+0x2a/0x34 queuedspinlockslowpath+0x476/0x480 dorawspinlock+0x1c2/0x1d0 kyberbiomerge+0x112/0x180 blkmqsubmitbio+0x1f5/0x1100 submitbionoacct+0x7b0/0x870 submitbio+0xc2/0x3a0 btrfsmapbio+0x4f0/0x9d0 btrfssubmitdatabio+0x24e/0x310 submitonebio+0x7f/0xb0 submitextentpage+0xc4/0x440 extentwritepageio+0x2b8/0x5e0 extentwritepage+0x28d/0x6e0 extentwritecachepages+0x4d7/0x7a0 extentwritepages+0xa2/0x110 dowritepages+0x8f/0x180 writebacksingleinode+0x99/0x7f0 writebacksbinodes+0x34e/0x790 writebackinodeswb+0x9e/0x120 wbwriteback+0x4d2/0x660 wbworkfn+0x64d/0xa10 processonework+0x53a/0xa80 workerthread+0x69/0x5b0 kthread+0x20b/0x240 retfromfork+0x1f/0x30
Only Kyber uses the hctx, so fix it by passing the requestqueue to ->biomerge() instead. BFQ and mq-deadline just use that, and Kyber can map the queues itself to avoid the mismatch.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
kyber: fix out of bounds access when preempted
The Linux kernel CVE team has assigned CVE-2021-46984 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024022824-CVE-2021-46984-e55e@gregkh/T/#u
— Red Hat
Linux Kernel could allow a local attacker to obtain sensitive information, caused by an out-of-bounds read flaw when preempted. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-46984?
CVE-2021-46984 has a moderate severity rating due to the potential for out of bounds access in the Linux kernel.
How do I fix CVE-2021-46984?
To fix CVE-2021-46984, you should upgrade to kernel versions 5.4.120, 5.10.38, 5.11.22, 5.12.5, or 5.13.
Which versions of the Linux kernel are affected by CVE-2021-46984?
CVE-2021-46984 affects Linux kernel versions prior to 5.4.120, 5.10.38, 5.11.22, 5.12.5, and 5.13.
What type of vulnerability is CVE-2021-46984?
CVE-2021-46984 is an out of bounds access vulnerability that can occur when the kyber scheduler is preempted.
Is it safe to continue using versions of the Linux kernel affected by CVE-2021-46984?
Continuing to use affected versions of the Linux kernel poses security risks, and it is recommended to apply the patches as soon as possible.