CVE-2021-47368

enetc: Fix illegal access when reading affinity_hint

Severity Score

8.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

enetc: Fix illegal access when reading affinity_hint

irq_set_affinity_hit() stores a reference to the cpumask_t
parameter in the irq descriptor, and that reference can be
accessed later from irq_affinity_hint_proc_show(). Since
the cpu_mask parameter passed to irq_set_affinity_hit() has
only temporary storage (it's on the stack memory), later
accesses to it are illegal. Thus reads from the corresponding
procfs affinity_hint file can result in paging request oops.

The issue is fixed by the get_cpu_mask() helper, which provides
a permanent storage for the cpumask_t parameter.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: enetc: corrige el acceso ilegal al leer affinity_hint irq_set_affinity_hit() almacena una referencia al parámetro cpumask_t en el descriptor irq, y se puede acceder a esa referencia más tarde desde irq_affinity_hint_proc_show(). Dado que el parámetro cpu_mask pasado a irq_set_affinity_hit() solo tiene almacenamiento temporal (está en la memoria de la pila), los accesos posteriores a él son ilegales. Por lo tanto, las lecturas del archivo procfs affinity_hint correspondiente pueden dar como resultado una solicitud de paginación. El problema lo soluciona el asistente get_cpu_mask(), que proporciona un almacenamiento permanente para el parámetro cpumask_t.

*Credits: N/A

CVSS Scores

CISAv3.1 8.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-21 CVE Reserved
2024-05-21 CVE Published
2024-05-22 EPSS Updated
2024-12-19 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-400: Uncontrolled Resource Consumption

CAPEC

References (5)

URL	Tag	Source
https://git.kernel.org/stable/c/d4fd0404c1c95b17880f254ebfee3485693fa8ba	Vuln. Introduced

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/4c4c3052911b577920353a7646e4883d5da40c28	2021-09-30
https://git.kernel.org/stable/c/6c3f1b741c6c2914ea120e3a5790d3e900152f7b	2021-09-30
https://git.kernel.org/stable/c/6f329d9da2a5ae032fcde800a99b118124ed5270	2021-09-30
https://git.kernel.org/stable/c/7237a494decfa17d0b9d0076e6cee3235719de90	2021-09-19

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.1 < 5.4.150 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.1 < 5.4.150"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.1 < 5.10.70 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.1 < 5.10.70"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.1 < 5.14.9 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.1 < 5.14.9"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.1 < 5.15 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.1 < 5.15"		en		Affected