CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2021-47465 – KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()
https://notcve.org/view.php?id=CVE-2021-47465
In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() In commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") kvm_start_guest() became idle_kvm_start_guest(). The old code allocated a stack frame on the emergency stack, but didn't use the frame to store anything, and also didn't store anything in its caller's frame. idle_kvm_start_guest() on the other hand is written more like a normal C function, it creates a frame on entry, and also stores CR/LR into its callers frame (per the ABI). The problem is that there is no caller frame on the emergency stack. The emergency stack for a given CPU is allocated with: paca_ptrs[i]->emergency_sp = alloc_stack(limit, i) + THREAD_SIZE; So emergency_sp actually points to the first address above the emergency stack allocation for a given CPU, we must not store above it without first decrementing it to create a frame. This is different to the regular kernel stack, paca->kstack, which is initialised to point at an initial frame that is ready to use. idle_kvm_start_guest() stores the backchain, CR and LR all of which write outside the allocation for the emergency stack. It then creates a stack frame and saves the non-volatile registers. • https://git.kernel.org/stable/c/10d91611f426d4bafd2a83d966c36da811b2f7ad https://git.kernel.org/stable/c/80bbb0bc3a0288442f7fe6fc514f4ee1cb06ccb7 https://git.kernel.org/stable/c/fbd724c49bead048ae9fc1a5b7bff2fb3e54f855 https://git.kernel.org/stable/c/6d077c37c4643394b1bae9682da48164fc147ea8 https://git.kernel.org/stable/c/9b4416c5095c20e110c82ae602c254099b83b72f •
CVSS: 7.4EPSS: 0%CPEs: 4EXPL: 0CVE-2021-47464 – audit: fix possible null-pointer dereference in audit_filter_rules
https://notcve.org/view.php?id=CVE-2021-47464
In the Linux kernel, the following vulnerability has been resolved: audit: fix possible null-pointer dereference in audit_filter_rules Fix possible null-pointer dereference in audit_filter_rules. audit_filter_rules() error: we previously assumed 'ctx' could be null En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: auditoría: corrige una posible desreferencia de puntero nulo en audit_filter_rules. Corrige una posible desreferencia de puntero nulo en audit_filter_rules. Error audit_filter_rules(): previamente asumimos que 'ctx' podría ser nulo • https://git.kernel.org/stable/c/bf361231c295d92a28ca283ea713f56e93e55796 https://git.kernel.org/stable/c/d6f451f1f60c58d73038c7c3177066f8f084e2a2 https://git.kernel.org/stable/c/16802fa4c33eb1a8efb23f1e93365190e4047d05 https://git.kernel.org/stable/c/4e9e46a700201b4c85081fd478c99c692a9aaa0d https://git.kernel.org/stable/c/6e3ee990c90494561921c756481d0e2125d8b895 • CWE-476: NULL Pointer Dereference •
CVSS: 7.0EPSS: 0%CPEs: 3EXPL: 0CVE-2021-47461 – userfaultfd: fix a race between writeprotect and exit_mmap()
https://notcve.org/view.php?id=CVE-2021-47461
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix a race between writeprotect and exit_mmap() A race is possible when a process exits, its VMAs are removed by exit_mmap() and at the same time userfaultfd_writeprotect() is called. The race was detected by KASAN on a development kernel, but it appears to be possible on vanilla kernels as well. Use mmget_not_zero() to prevent the race as done in other userfaultfd operations. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: userfaultfd: corrige una ejecución entre writeprotect y exit_mmap() Una ejecución es posible cuando un proceso sale, sus VMA son eliminados por exit_mmap() y al mismo tiempo se llama a userfaultfd_writeprotect() . KASAN detectó la ejecución en un núcleo de desarrollo, pero parece ser posible también en núcleos de vainilla. Utilice mmget_not_zero() para evitar la ejecución como se hace en otras operaciones de userfaultfd. A possible race condition flaw was found in the Linux kernel. • https://git.kernel.org/stable/c/63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 https://git.kernel.org/stable/c/3cda4bfffd4f755645577aaa9e96a606657b4525 https://git.kernel.org/stable/c/149958ecd0627a9f1e9c678c25c665400054cd6a https://git.kernel.org/stable/c/cb185d5f1ebf900f4ae3bf84cee212e6dd035aca https://access.redhat.com/security/cve/CVE-2021-47461 https://bugzilla.redhat.com/show_bug.cgi?id=2282896 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2021-47460 – ocfs2: fix data corruption after conversion from inline format
https://notcve.org/view.php?id=CVE-2021-47460
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after conversion from inline format Commit 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()") uncovered a latent bug in ocfs2 conversion from inline inode format to a normal inode format. The code in ocfs2_convert_inline_data_to_extents() attempts to zero out the whole cluster allocated for file data by grabbing, zeroing, and dirtying all pages covering this cluster. However these pages are beyond i_size, thus writeback code generally ignores these dirty pages and no blocks were ever actually zeroed on the disk. This oversight was fixed by commit 693c241a5f6a ("ocfs2: No need to zero pages past i_size.") for standard ocfs2 write path, inline conversion path was apparently forgotten; the commit log also has a reasoning why the zeroing actually is not needed. After commit 6dbf7bb55598, things became worse as writeback code stopped invalidating buffers on pages beyond i_size and thus these pages end up with clean PageDirty bit but with buffers attached to these pages being still dirty. So when a file is converted from inline format, then writeback triggers, and then the file is grown so that these pages become valid, the invalid dirtiness state is preserved, mark_buffer_dirty() does nothing on these pages (buffers are already dirty) but page is never written back because it is clean. So data written to these pages is lost once pages are reclaimed. Simple reproducer for the problem is: xfs_io -f -c "pwrite 0 2000" -c "pwrite 2000 2000" -c "fsync" \ -c "pwrite 4000 2000" ocfs2_file After unmounting and mounting the fs again, you can observe that end of 'ocfs2_file' has lost its contents. Fix the problem by not doing the pointless zeroing during conversion from inline format similarly as in the standard write path. [akpm@linux-foundation.org: fix whitespace, per Joseph] En el kernel de Linux, se resolvió la siguiente vulnerabilidad: ocfs2: corrige la corrupción de datos después de la conversión desde el formato en línea. el commit 6dbf7bb55598 ("fs: No invalide los buffers de página en block_write_full_page()") descubrió un error latente en la conversión de ocfs2 desde el inodo en línea. formato a un formato de inodo normal. El código en ocfs2_convert_inline_data_to_extents() intenta poner a cero todo el clúster asignado para datos de archivos capturando, poniendo a cero y ensuciando todas las páginas que cubren este clúster. • https://git.kernel.org/stable/c/acef5107e2eacb08a16ad5db60320d65bd26a6c0 https://git.kernel.org/stable/c/7ed80e77c908cbaa686529a49f8ae0060c5caee7 https://git.kernel.org/stable/c/7ce2b16bad2cbfa3fa7bbc42c4448914f639ca47 https://git.kernel.org/stable/c/f8a6a2ed4b7d1c3c8631eeb6d00572bc853094a8 https://git.kernel.org/stable/c/6dbf7bb555981fb5faf7b691e8f6169fc2b2e63b https://git.kernel.org/stable/c/36ed9e604215f58cec0381ca5fcc6da05f2d87ca https://git.kernel.org/stable/c/560edd14de2bf9dbc0129681eeb4d5ef87cc105f https://git.kernel.org/stable/c/8e6bfb4f70168ddfd32fb6dc028ad52fa •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-47459 – can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
https://notcve.org/view.php?id=CVE-2021-47459
In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv It will trigger UAF for rx_kref of j1939_priv as following. cpu0 cpu1 j1939_sk_bind(socket0, ndev0, ...) j1939_netdev_start j1939_sk_bind(socket1, ndev0, ...) j1939_netdev_start j1939_priv_set j1939_priv_get_by_ndev_locked j1939_jsk_add ..... j1939_netdev_stop kref_put_lock(&priv->rx_kref, ...) kref_get(&priv->rx_kref, ...) REFCOUNT_WARN("addition on 0;...") ==================================================== refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 RIP: 0010:refcount_warn_saturate+0x169/0x1e0 Call Trace: j1939_netdev_start+0x68b/0x920 j1939_sk_bind+0x426/0xeb0 ? security_socket_bind+0x83/0xb0 The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to protect. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: j1939: j1939_netdev_start(): arreglar UAF para rx_kref de j1939_priv Activará UAF para rx_kref de j1939_priv de la siguiente manera. cpu0 cpu1 j1939_sk_bind(socket0, ndev0, ...) j1939_netdev_start j1939_sk_bind(socket1, ndev0, ...) j1939_netdev_start j1939_priv_set j1939_priv_get_by_ndev_locked j1939_jsk_add ..... kref_put_lock(&priv->rx_kref, ...) kref_get(&priv->rx_kref , ...) REFCOUNT_WARN("adición en 0;...") ================================== ==================== refcount_t: suma en 0; use-after-free. ADVERTENCIA: CPU: 1 PID: 20874 en lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 RIP: 0010:refcount_warn_saturate+0x169/0x1e0 Seguimiento de llamadas: j1939_netdev_start+0x68b/0x920 j1939_sk_bind+0x426 /0xeb0 ? • https://git.kernel.org/stable/c/9d71dd0c70099914fcd063135da3c580865e924c https://git.kernel.org/stable/c/a0e47d2833b4f65e6c799f28c6b636d36b8b936d https://git.kernel.org/stable/c/864e77771a24c877aaf53aee019f78619cbcd668 https://git.kernel.org/stable/c/6e8811707e2df0c6ba920f0cad3a3bca7b42132f https://git.kernel.org/stable/c/d9d52a3ebd284882f5562c88e55991add5d01586 https://access.redhat.com/security/cve/CVE-2021-47459 https://bugzilla.redhat.com/show_bug.cgi?id=2282898 • CWE-416: Use After Free •