CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2021-47179 – NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()
https://notcve.org/view.php?id=CVE-2021-47179
In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() Commit de144ff4234f changes _pnfs_return_layout() to call pnfs_mark_matching_lsegs_return() passing NULL as the struct pnfs_layout_range argument. Unfortunately, pnfs_mark_matching_lsegs_return() doesn't check if we have a value here before dereferencing it, causing an oops. I'm able to hit this crash consistently when running connectathon basic tests on NFS v4.1/v4.2 against Ontap. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFSv4: corrige una desreferencia de puntero NULL en pnfs_mark_matching_lsegs_return(). Confirme los cambios de144ff4234f _pnfs_return_layout() para llamar a pnfs_mark_matching_lsegs_return() pasando NULL como argumento de estructura pnfs_layout_range. Desafortunadamente, pnfs_mark_matching_lsegs_return() no verifica si tenemos un valor aquí antes de eliminar la referencia a él, lo que provoca un error. • https://git.kernel.org/stable/c/80e34f4957ec3010c85f9bb0b568a8d46acdf535 https://git.kernel.org/stable/c/7b7b9774643220e53eef58c15bb29bd4182fe053 https://git.kernel.org/stable/c/9ffa7967f9379a0a1b924e9ffeda709d72237da7 https://git.kernel.org/stable/c/6be0e4b59314e4a836495f6ffdc5d2c5b079deeb https://git.kernel.org/stable/c/2fafe7d5047f98791afd9a1d90d2afb70debc590 https://git.kernel.org/stable/c/7e65ea887d0c0997f3053acd91a027af45e71c5b https://git.kernel.org/stable/c/96260bde1ea8ae31a5402fe506abbb8951d5a42c https://git.kernel.org/stable/c/4e1ba532dbc1a0e19fc2458d74ab8d986 • CWE-476: NULL Pointer Dereference •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2021-47178 – scsi: target: core: Avoid smp_processor_id() in preemptible code
https://notcve.org/view.php?id=CVE-2021-47178
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Avoid smp_processor_id() in preemptible code The BUG message "BUG: using smp_processor_id() in preemptible [00000000] code" was observed for TCMU devices with kernel config DEBUG_PREEMPT. The message was observed when blktests block/005 was run on TCMU devices with fileio backend or user:zbc backend [1]. The commit 1130b499b4a7 ("scsi: target: tcm_loop: Use LIO wq cmd submission helper") triggered the symptom. The commit modified work queue to handle commands and changed 'current->nr_cpu_allowed' at smp_processor_id() call. The message was also observed at system shutdown when TCMU devices were not cleaned up [2]. The function smp_processor_id() was called in SCSI host work queue for abort handling, and triggered the BUG message. This symptom was observed regardless of the commit 1130b499b4a7 ("scsi: target: tcm_loop: Use LIO wq cmd submission helper"). To avoid the preemptible code check at smp_processor_id(), get CPU ID with raw_smp_processor_id() instead. • https://git.kernel.org/stable/c/1526d9f10c6184031e42afad0adbdde1213e8ad1 https://git.kernel.org/stable/c/a20b6eaf4f35046a429cde57bee7eb5f13d6857f https://git.kernel.org/stable/c/70ca3c57ff914113f681e657634f7fbfa68e1ad1 https://git.kernel.org/stable/c/a222d2794c53f8165de20aa91b39e35e4b72bce9 •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2021-47177 – iommu/vt-d: Fix sysfs leak in alloc_iommu()
https://notcve.org/view.php?id=CVE-2021-47177
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix sysfs leak in alloc_iommu() iommu_device_sysfs_add() is called before, so is has to be cleaned on subsequent errors. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: iommu/vt-d: corrige la fuga de sysfs en alloc_iommu() iommu_device_sysfs_add() se llama antes, por lo que debe limpiarse en caso de errores posteriores. • https://git.kernel.org/stable/c/39ab9555c24110671f8dc671311a26e5c985b592 https://git.kernel.org/stable/c/22da9f4978381a99f1abaeaf6c9b83be6ab5ddd8 https://git.kernel.org/stable/c/2ec5e9bb6b0560c90d315559c28a99723c80b996 https://git.kernel.org/stable/c/044bbe8b92ab4e542de7f6c93c88ea65cccd8e29 https://git.kernel.org/stable/c/f01134321d04f47c718bb41b799bcdeda27873d2 https://git.kernel.org/stable/c/ca466561eef36d1ec657673e3944eb6340bddb5b https://git.kernel.org/stable/c/0ee74d5a48635c848c20f152d0d488bf84641304 •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2021-47176 – s390/dasd: add missing discipline function
https://notcve.org/view.php?id=CVE-2021-47176
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: add missing discipline function Fix crash with illegal operation exception in dasd_device_tasklet. Commit b72949328869 ("s390/dasd: Prepare for additional path event handling") renamed the verify_path function for ECKD but not for FBA and DIAG. This leads to a panic when the path verification function is called for a FBA or DIAG device. Fix by defining a wrapper function for dasd_generic_verify_path(). En el kernel de Linux, se resolvió la siguiente vulnerabilidad: s390/dasd: agregar función de disciplina faltante. Se corrigió falla con excepción de operación ilegal en dasd_device_tasklet. El commit b72949328869 ("s390/dasd: Prepárese para el manejo de eventos de ruta adicional") cambió el nombre de la función verificar_ruta para ECKD pero no para Logística de Amazon y DIAG. Esto provoca pánico cuando se llama a la función de verificación de ruta para un dispositivo FBA o DIAG. • https://git.kernel.org/stable/c/8bc5a76268fb334236296b4c185b8337e0d85473 https://git.kernel.org/stable/c/72aebdac390bf0dc04c0385d2db7ee522f4ffa3c https://git.kernel.org/stable/c/b72949328869dfd45f6452c2410647afd7db5f1a https://git.kernel.org/stable/c/6a16810068e70959bc1df686424aa35ce05578f1 https://git.kernel.org/stable/c/aa8579bc084673c651204f7cd0d6308a47dffc16 https://git.kernel.org/stable/c/a16be88a3d7e5efcb59a15edea87a8bd369630c6 https://git.kernel.org/stable/c/c0c8a8397fa8a74d04915f4d3d28cb4a5d401427 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2021-47175 – net/sched: fq_pie: fix OOB access in the traffic path
https://notcve.org/view.php?id=CVE-2021-47175
In the Linux kernel, the following vulnerability has been resolved: net/sched: fq_pie: fix OOB access in the traffic path the following script: # tc qdisc add dev eth0 handle 0x1 root fq_pie flows 2 # tc qdisc add dev eth0 clsact # tc filter add dev eth0 egress matchall action skbedit priority 0x10002 # ping 192.0.2.2 -I eth0 -c2 -w1 -q produces the following splat: BUG: KASAN: slab-out-of-bounds in fq_pie_qdisc_enqueue+0x1314/0x19d0 [sch_fq_pie] Read of size 4 at addr ffff888171306924 by task ping/942 CPU: 3 PID: 942 Comm: ping Not tainted 5.12.0+ #441 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace: dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 fq_pie_qdisc_enqueue+0x1314/0x19d0 [sch_fq_pie] __dev_queue_xmit+0x1034/0x2b10 ip_finish_output2+0xc62/0x2120 __ip_finish_output+0x553/0xea0 ip_output+0x1ca/0x4d0 ip_send_skb+0x37/0xa0 raw_sendmsg+0x1c4b/0x2d00 sock_sendmsg+0xdb/0x110 __sys_sendto+0x1d7/0x2b0 __x64_sys_sendto+0xdd/0x1b0 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fe69735c3eb Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 75 42 2c 00 41 89 ca 8b 00 85 c0 75 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 41 57 4d 89 c7 41 56 41 89 RSP: 002b:00007fff06d7fb38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055e961413700 RCX: 00007fe69735c3eb RDX: 0000000000000040 RSI: 000055e961413700 RDI: 0000000000000003 RBP: 0000000000000040 R08: 000055e961410500 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff06d81260 R13: 00007fff06d7fb40 R14: 00007fff06d7fc30 R15: 000055e96140f0a0 Allocated by task 917: kasan_save_stack+0x19/0x40 __kasan_kmalloc+0x7f/0xa0 __kmalloc_node+0x139/0x280 fq_pie_init+0x555/0x8e8 [sch_fq_pie] qdisc_create+0x407/0x11b0 tc_modify_qdisc+0x3c2/0x17e0 rtnetlink_rcv_msg+0x346/0x8e0 netlink_rcv_skb+0x120/0x380 netlink_unicast+0x439/0x630 netlink_sendmsg+0x719/0xbf0 sock_sendmsg+0xe2/0x110 ____sys_sendmsg+0x5ba/0x890 ___sys_sendmsg+0xe9/0x160 __sys_sendmsg+0xd3/0x170 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff888171306800 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 36 bytes to the right of 256-byte region [ffff888171306800, ffff888171306900) The buggy address belongs to the page: page:00000000bcfb624e refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x171306 head:00000000bcfb624e order:1 compound_mapcount:0 flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0010200 dead000000000100 dead000000000122 ffff888100042b40 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888171306800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888171306880: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc >ffff888171306900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888171306980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888171306a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fix fq_pie traffic path to avoid selecting 'q->flows + q->flows_cnt' as a valid flow: it's an address beyond the allocated memory. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: fq_pie: arregla el acceso OOB en la ruta de tráfico el siguiente script: # tc qdisc add dev eth0 handle 0x1 root fq_pie flows 2 # tc qdisc add dev eth0 clsact # tc filtrar agregar dev eth0 salida matchall acción skbedit prioridad 0x10002 # ping 192.0.2.2 -I eth0 -c2 -w1 -q produce el siguiente símbolo: ERROR: KASAN: slab-out-of-bounds in fq_pie_qdisc_enqueue+0x1314/0x19d0 [sch_fq_pie] Leer de tamaño 4 en la dirección ffff888171306924 por tarea ping/942 CPU: 3 PID: 942 Comm: ping Not tainted 5.12.0+ #441 Nombre de hardware: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+ 0f1aadab 01/04/2014 Seguimiento de llamadas: dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 fq_pie_qdisc_enqueue+0x1314/0x19d0 [sch_fq_pie] __dev_queue_x mit+0x1034/0x2b10 ip_finish_output2+0xc62/0x2120 __ip_finish_output+0x553/0xea0 ip_output+0x1ca/0x4d0 ip_send_skb+0x37/0xa0 raw_sendmsg+0x1c4b/0x2d00 sock_sendmsg+0xdb/0x110 __sys_sendto+0x1d7/0x2b0 __x64_sys_s endto+0xdd/0x1b0 do_syscall_64+0x3c/0x80 Entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fe69735c3eb Código: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 75 42 2c 00 41 89 ca 8b 00 85 c0 75 14 b8 2c 00 00 00 0f 05 <48 > 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 41 57 4d 89 c7 41 56 41 89 RSP: 002b:00007fff06d7fb38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055e961413700 RCX: 00007fe69735c3eb RDX: 0000000000000040 RSI: 000055e961413700 RDI: 0000000000000003 RBP: 0000000000000040 R08: 000055e961410500 R09: 00000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff06d81260 R13: 00007fff06d7fb40 R14: 00007fff06d7fc30 R15: 000055e96140f0a0 Asignado por la tarea 917: kasan_save_stack+0x19/0x40 __kasan_kmalloc+0x7f/0xa0 __kmalloc_node+0x139/0x280 fq_pie_init+0x555/0x8e8 [ sch_fq_pie] qdisc_create+0x407/0x11b0 tc_modify_qdisc+0x3c2/0x17e0 rtnetlink_rcv_msg+0x346/0x8e0 netlink_rcv_skb+0x120/0x380 netlink_unicast+0x439/0x630 netlink_sendmsg+0x719/ 0xbf0 sock_sendmsg+0xe2/0x110 ____sys_sendmsg+0x5ba/0x890 ___sys_sendmsg+0xe9/0x160 __sys_sendmsg+0xd3 /0x170 do_syscall_64+0x3c/0x80 Entry_SYSCALL_64_after_hwframe+0x44/0xae La dirección con errores pertenece al objeto en ffff888171306800 que pertenece al caché kmalloc-256 de tamaño 256. La dirección con errores se encuentra 36 bytes a la derecha de la región de 256 bytes [ffff888171306 800, ffff888171306900) La dirección del error pertenece a la página: página:00000000bcfb624e refcount:1 mapcount:0 mapeo:0000000000000000 index:0x0 pfn:0x171306 head:00000000bcfb624e order:1 composite_mapcount:0 flags: 0x17ffffc00 10200(losa|cabeza|nodo=0|zona =2|lastcpupid=0x1fffff) raw: 0017ffffc0010200 dead000000000100 dead000000000122 ffff888100042b40 raw: 000000000000000000 0000000000100010 00000001ffffffff 0000000000000000 página volcada porque: kasan: se detectó mal acceso Estado de la memoria alrededor de la dirección con errores: ffff888171306800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888171306880: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc >ffff888171306900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888 171306980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888171306a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb corrige la ruta de tráfico fq_pie para evitar seleccionar 'q->flows + q->flows_cnt' como un flujo válido: es una dirección más allá de la memoria asignada. • https://git.kernel.org/stable/c/ec97ecf1ebe485a17cd8395a5f35e6b80b57665a https://git.kernel.org/stable/c/e6294c06e7c62ffdd5bf3df696d3a4fcbb753d3c https://git.kernel.org/stable/c/7a1bdec12e43e29cc34a4394590337069d8812ce https://git.kernel.org/stable/c/e70f7a11876a1a788ceadf75e9e5f7af2c868680 •