目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2021-47118— Linux kernel 安全漏洞

一分钟漏洞结论

影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 pid 模块存在引用计数错误。

AI 预测 7.8 利用难度: 困难 EPSS 0.25% · P15

影响版本矩阵 18

厂商产品 版本范围状态
Linux Linux 9ec52099e4b8678a60e9f93e41ad87885d64f3e6< 764c2e892d1fe895392aff62fb353fdce43bb529 affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< f86c80515a8a3703e0ca2e56deb50fc2879c5ea4 affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< 4dbd8808a591b49b717862e6e0081bcf14a87788 affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< d106f05432e60f9f62d456ef017687f5c73cb414 affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< 2cd6eedfa6344f5ef5c3dac3aee57a39b5b46dff affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< 7178be006d495ffb741c329012da289b62dddfe6 affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< b8ff869f20152fbe66b6c2e2715d26a2f9897cca affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< 0711f0d7050b9e07c44bc159bbc64ac0a1022c7f affected
… +10 条更多
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2021-47118 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
pid: take a reference when initializing `cad_pid`
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when initializing `cad_pid` During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will increment the refcount on the new pid via get_pid(), and will decrement the refcount on the old pid via put_pid(). As we never called get_pid() when we initialized `cad_pid`, we decrement a reference we never incremented, can therefore free the init task's struct pid early. As there can be dangling references to the struct pid, we can later encounter a use-after-free (e.g. when delivering signals). This was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to have been around since the conversion of `cad_pid` to struct pid in commit 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid") from the pre-KASAN stone age of v2.6.19. Fix this by getting a reference to the init task's struct pid when we assign it to `cad_pid`. Full KASAN splat below. ================================================================== BUG: KASAN: use-after-free in ns_of_pid include/linux/pid.h:153 [inline] BUG: KASAN: use-after-free in task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 Read of size 4 at addr ffff23794dda0004 by task syz-executor.0/273 CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1 Hardware name: linux,dummy-virt (DT) Call trace: ns_of_pid include/linux/pid.h:153 [inline] task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 do_notify_parent+0x308/0xe60 kernel/signal.c:1950 exit_notify kernel/exit.c:682 [inline] do_exit+0x2334/0x2bd0 kernel/exit.c:845 do_group_exit+0x108/0x2c8 kernel/exit.c:922 get_signal+0x4e4/0x2a88 kernel/signal.c:2781 do_signal arch/arm64/kernel/signal.c:882 [inline] do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936 work_pending+0xc/0x2dc Allocated by task 0: slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516 slab_alloc_node mm/slub.c:2907 [inline] slab_alloc mm/slub.c:2915 [inline] kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920 alloc_pid+0xdc/0xc00 kernel/pid.c:180 copy_process+0x2794/0x5e18 kernel/fork.c:2129 kernel_clone+0x194/0x13c8 kernel/fork.c:2500 kernel_thread+0xd4/0x110 kernel/fork.c:2552 rest_init+0x44/0x4a0 init/main.c:687 arch_call_rest_init+0x1c/0x28 start_kernel+0x520/0x554 init/main.c:1064 0x0 Freed by task 270: slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600 slab_free mm/slub.c:3161 [inline] kmem_cache_free+0x224/0x8e0 mm/slub.c:3177 put_pid.part.4+0xe0/0x1a8 kernel/pid.c:114 put_pid+0x30/0x48 kernel/pid.c:109 proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401 proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591 proc_sys_write+0x34/0x48 fs/proc/proc_sysctl.c:617 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x3ac/0x510 fs/read_write.c:518 vfs_write fs/read_write.c:605 [inline] vfs_write+0x9c4/0x1018 fs/read_write.c:585 ksys_write+0x124/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write fs/read_write.c:667 [inline] __arm64_sys_write+0x78/0xb0 fs/read_write.c:667 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline] el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129 do_el0_svc+0xf8/0x150 arch/arm64/kernel/syscall.c:168 el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416 el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432 el0_sync+0x154/0x180 arch/arm64/kernel/entry.S:701 The buggy address belongs to the object at ffff23794dda0000 which belongs to the cache pid of size 224 The buggy address is located 4 bytes inside of 224-byte region [ff ---truncated---
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 pid 模块存在引用计数错误。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD

受影响产品

厂商 产品 影响版本 CPE 订阅
Linux Linux 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 ~ 764c2e892d1fe895392aff62fb353fdce43bb529 -
Linux Linux 2.6.19 -

二、漏洞 CVE-2021-47118 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2021-47118 的情报信息

请登录查看更多情报信息。

CVE-2021-47118 其他参考 (8)

同批安全公告 · Linux · 2024-03-15 · 共 26 条

CVE-2021-47111 8.8 HIGH Linux kernel 安全漏洞
CVE-2021-47131 8.1 HIGH Linux kernel 安全漏洞
CVE-2021-47123 7.8 HIGH Linux kernel 安全漏洞
CVE-2021-47135 7.8 HIGH Linux kernel 安全漏洞
CVE-2021-47129 7.8 HIGH Linux kernel 安全漏洞
CVE-2021-47126 7.8 HIGH Linux kernel 安全漏洞
CVE-2021-47124 7.8 HIGH Linux kernel 安全漏洞
CVE-2021-47112 7.8 HIGH Linux kernel 安全漏洞
CVE-2021-47132 7.5 HIGH Linux kernel 安全漏洞
CVE-2021-47109 7.5 HIGH Linux kernel 安全漏洞
CVE-2021-47130 7.5 HIGH Linux kernel 安全漏洞
CVE-2021-47113 7.1 HIGH Linux kernel 安全漏洞
CVE-2021-47127 Linux kernel 安全漏洞
CVE-2021-47110 Linux kernel 安全漏洞
CVE-2021-47134 Linux kernel 安全漏洞
CVE-2021-47133 Linux kernel 安全漏洞
CVE-2021-47128 Linux kernel 安全漏洞
CVE-2021-47117 Linux kernel 安全漏洞
CVE-2021-47114 Linux kernel 安全漏洞
CVE-2021-47125 Linux kernel 安全漏洞

显示前 20 条，共 26 条。 查看全部 &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47118

暂无评论

发表评论