// For flags

CVE-2021-47130

nvmet: fix freeing unallocated p2pmem

Severity Score

4.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix freeing unallocated p2pmem

In case p2p device was found but the p2p pool is empty, the nvme target
is still trying to free the sgl from the p2p pool instead of the
regular sgl pool and causing a crash (BUG() is called). Instead, assign
the p2p_dev for the request only if it was allocated from p2p pool.

This is the crash that was caused:

[Sun May 30 19:13:53 2021] ------------[ cut here ]------------
[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!
[Sun May 30 19:13:53 2021] invalid opcode: 0000 [#1] SMP PTI
...
[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!
...
[Sun May 30 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0
...
[Sun May 30 19:13:53 2021] Call Trace:
[Sun May 30 19:13:53 2021] ------------[ cut here ]------------
[Sun May 30 19:13:53 2021] pci_free_p2pmem+0x2b/0x70
[Sun May 30 19:13:53 2021] pci_p2pmem_free_sgl+0x4f/0x80
[Sun May 30 19:13:53 2021] nvmet_req_free_sgls+0x1e/0x80 [nvmet]
[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!
[Sun May 30 19:13:53 2021] nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma]
[Sun May 30 19:13:53 2021] nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]

En el kernel de Linux, se resolvió la siguiente vulnerabilidad: nvmet: solución que libera p2pmem no asignado En caso de que se encuentre un dispositivo p2p pero el grupo p2p esté vacío, el objetivo nvme todavía está intentando liberar el sgl del grupo p2p en lugar del sgl normal. pool y provocando un bloqueo (se llama a BUG()). En su lugar, asigne p2p_dev para la solicitud solo si se asignó desde el grupo p2p. Este es el accidente que se provocó: [domingo 30 de mayo 19:13:53 2021] ------------[ cortar aquí ]------------ [domingo de mayo 30 19:13:53 2021] ¡ERROR del kernel en lib/genalloc.c:518! [domingo 30 de mayo 19:13:53 2021] código de operación no válido: 0000 [#1] SMP PTI... [domingo 30 de mayo 19:13:53 2021] ERROR del kernel en lib/genalloc.c:518. ... [dom 30 de mayo 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0 ... [dom 30 de mayo 19:13:53 2021] Seguimiento de llamadas: [dom 30 de mayo 19:13:53 2021 ] ------------[ cortar aquí ]------------ [domingo 30 de mayo 19:13:53 2021] pci_free_p2pmem+0x2b/0x70 [domingo 30 de mayo 19 :13:53 2021] pci_p2pmem_free_sgl+0x4f/0x80 [domingo 30 de mayo 19:13:53 2021] nvmet_req_free_sgls+0x1e/0x80 [nvmet] [domingo 30 de mayo 19:13:53 2021] ERROR del kernel en lib/genalloc.c: 518! [dom 30 de mayo 19:13:53 2021] nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma] [dom 30 de mayo 19:13:53 2021] nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-03-04 CVE Reserved
  • 2024-03-15 CVE Published
  • 2024-03-16 EPSS Updated
  • 2024-12-19 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.8 < 5.10.43
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.8 < 5.10.43"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.8 < 5.12.10
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.8 < 5.12.10"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.8 < 5.13
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.8 < 5.13"
en
Affected