Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-47118— pid: take a reference when initializing `cad_pid`

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 pid 模块存在引用计数错误。

AI Predicted 7.8 Difficulty: Hard EPSS 0.25% · P15

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 9ec52099e4b8678a60e9f93e41ad87885d64f3e6< 764c2e892d1fe895392aff62fb353fdce43bb529 affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< f86c80515a8a3703e0ca2e56deb50fc2879c5ea4 affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< 4dbd8808a591b49b717862e6e0081bcf14a87788 affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< d106f05432e60f9f62d456ef017687f5c73cb414 affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< 2cd6eedfa6344f5ef5c3dac3aee57a39b5b46dff affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< 7178be006d495ffb741c329012da289b62dddfe6 affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< b8ff869f20152fbe66b6c2e2715d26a2f9897cca affected
9ec52099e4b8678a60e9f93e41ad87885d64f3e6< 0711f0d7050b9e07c44bc159bbc64ac0a1022c7f affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-47118

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pid: take a reference when initializing `cad_pid`
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when initializing `cad_pid` During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will increment the refcount on the new pid via get_pid(), and will decrement the refcount on the old pid via put_pid(). As we never called get_pid() when we initialized `cad_pid`, we decrement a reference we never incremented, can therefore free the init task's struct pid early. As there can be dangling references to the struct pid, we can later encounter a use-after-free (e.g. when delivering signals). This was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to have been around since the conversion of `cad_pid` to struct pid in commit 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid") from the pre-KASAN stone age of v2.6.19. Fix this by getting a reference to the init task's struct pid when we assign it to `cad_pid`. Full KASAN splat below. ================================================================== BUG: KASAN: use-after-free in ns_of_pid include/linux/pid.h:153 [inline] BUG: KASAN: use-after-free in task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 Read of size 4 at addr ffff23794dda0004 by task syz-executor.0/273 CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1 Hardware name: linux,dummy-virt (DT) Call trace: ns_of_pid include/linux/pid.h:153 [inline] task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 do_notify_parent+0x308/0xe60 kernel/signal.c:1950 exit_notify kernel/exit.c:682 [inline] do_exit+0x2334/0x2bd0 kernel/exit.c:845 do_group_exit+0x108/0x2c8 kernel/exit.c:922 get_signal+0x4e4/0x2a88 kernel/signal.c:2781 do_signal arch/arm64/kernel/signal.c:882 [inline] do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936 work_pending+0xc/0x2dc Allocated by task 0: slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516 slab_alloc_node mm/slub.c:2907 [inline] slab_alloc mm/slub.c:2915 [inline] kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920 alloc_pid+0xdc/0xc00 kernel/pid.c:180 copy_process+0x2794/0x5e18 kernel/fork.c:2129 kernel_clone+0x194/0x13c8 kernel/fork.c:2500 kernel_thread+0xd4/0x110 kernel/fork.c:2552 rest_init+0x44/0x4a0 init/main.c:687 arch_call_rest_init+0x1c/0x28 start_kernel+0x520/0x554 init/main.c:1064 0x0 Freed by task 270: slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600 slab_free mm/slub.c:3161 [inline] kmem_cache_free+0x224/0x8e0 mm/slub.c:3177 put_pid.part.4+0xe0/0x1a8 kernel/pid.c:114 put_pid+0x30/0x48 kernel/pid.c:109 proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401 proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591 proc_sys_write+0x34/0x48 fs/proc/proc_sysctl.c:617 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x3ac/0x510 fs/read_write.c:518 vfs_write fs/read_write.c:605 [inline] vfs_write+0x9c4/0x1018 fs/read_write.c:585 ksys_write+0x124/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write fs/read_write.c:667 [inline] __arm64_sys_write+0x78/0xb0 fs/read_write.c:667 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline] el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129 do_el0_svc+0xf8/0x150 arch/arm64/kernel/syscall.c:168 el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416 el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432 el0_sync+0x154/0x180 arch/arm64/kernel/entry.S:701 The buggy address belongs to the object at ffff23794dda0000 which belongs to the cache pid of size 224 The buggy address is located 4 bytes inside of 224-byte region [ff ---truncated---
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 pid 模块存在引用计数错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 ~ 764c2e892d1fe895392aff62fb353fdce43bb529 -
Linux Linux 2.6.19 -

II. Public POCs for CVE-2021-47118

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-47118

请登录查看更多情报信息。

Other References for CVE-2021-47118 (8)

Same Patch Batch · Linux · 2024-03-15 · 26 CVEs total

CVE-2021-47111 8.8 HIGH xen-netback: take a reference to the RX task thread
CVE-2021-47131 8.1 HIGH net/tls: Fix use-after-free after the TLS device goes down and up
CVE-2021-47123 7.8 HIGH io_uring: fix ltout double free on completion race
CVE-2021-47135 7.8 HIGH mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report
CVE-2021-47129 7.8 HIGH netfilter: nft_ct: skip expectations for confirmed conntrack
CVE-2021-47126 7.8 HIGH ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions
CVE-2021-47124 7.8 HIGH io_uring: fix link timeout refs
CVE-2021-47112 7.8 HIGH x86/kvm: Teardown PV features on boot CPU as well
CVE-2021-47132 7.5 HIGH mptcp: fix sk_forward_memory corruption on retransmission
CVE-2021-47109 7.5 HIGH neighbour: allow NUD_NOARP entries to be forced GCed
CVE-2021-47130 7.5 HIGH nvmet: fix freeing unallocated p2pmem
CVE-2021-47113 7.1 HIGH btrfs: abort in rename_exchange if we fail to insert the second ref
CVE-2021-47127 ice: track AF_XDP ZC enabled queues in bitmap
CVE-2021-47110 x86/kvm: Disable kvmclock on all CPUs on shutdown
CVE-2021-47134 efi/fdt: fix panic when no valid fdt found
CVE-2021-47133 HID: amd_sfh: Fix memory leak in amd_sfh_work
CVE-2021-47128 bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks
CVE-2021-47117 ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed
CVE-2021-47114 ocfs2: fix data corruption by fallocate
CVE-2021-47125 sch_htb: fix refcount leak in htb_parent_to_leaf_offload

Showing top 20 of 26 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47118

No comments yet

Leave a comment