CVE-2021-47393

一、漏洞信息
 漏洞编号：[CVE-2021-47393](https://nvd.nist.gov/vuln/detail/CVE-2021-47393)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfsFan speed minimum can be enforced from sysfs. For example, settingcurrent fan speed to 20 is used to enforce fan speed to be at 100%speed, 19 - to be not below 90% speed, etcetera. This feature providesability to limit fan speed according to some system wiseconsiderations, like absence of some replaceable units or high systemambient temperature.Request for changing fan minimum speed is configuration request and canbe set only through  sysfs  write procedure. In this situation value ofargument  state  is above nominal fan speed maximum.Return non-zero code in this case to avoidthermal_cooling_device_stats_update() call, because in this casestatistics update violates thermal statistics table range.The issues is observed in case kernel is configured with optionCONFIG_THERMAL_STATISTICS.Here is the trace from KASAN:[  159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0[  159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444[  159.545625] Call Trace:[  159.548366]  dump_stack+0x92/0xc1[  159.552084]  ? thermal_cooling_device_stats_update+0x7d/0xb0[  159.635869]  thermal_zone_device_update+0x345/0x780[  159.688711]  thermal_zone_device_set_mode+0x7d/0xc0[  159.694174]  mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core][  159.700972]  ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core][  159.731827]  mlxsw_thermal_init+0x763/0x880 [mlxsw_core][  160.070233] RIP: 0033:0x7fd995909970[  160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ..[  160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001[  160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970[  160.111710] RDX: 0000000000000013 RSI: 0000000001906008 RDI: 0000000000000001[  160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700[  160.127687] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000013[  160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013[  160.143671][  160.145338] Allocated by task 2924:[  160.149242]  kasan_save_stack+0x19/0x40[  160.153541]  __kasan_kmalloc+0x7f/0xa0[  160.157743]  __kmalloc+0x1a2/0x2b0[  160.161552]  thermal_cooling_device_setup_sysfs+0xf9/0x1a0[  160.167687]  __thermal_cooling_device_register+0x1b5/0x500[  160.173833]  devm_thermal_of_cooling_device_register+0x60/0xa0[  160.180356]  mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan][  160.248140][  160.249807] The buggy address belongs to the object at ffff888116163400[  160.249807]  which belongs to the cache kmalloc-1k of size 1024[  160.263814] The buggy address is located 64 bytes to the right of[  160.263814]  1024-byte region [ffff888116163400, ffff888116163800)[  160.277536] The buggy address belongs to the page:[  160.282898] page:0000000012275840 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116167000 pfn:0x116160[  160.294872] head:0000000012275840 order:3 compound_mapcount:0 compound_pincount:0[  160.303251] flags: 0x200000000010200(slab|head|node=0|zone=2)[  160.309694] raw: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0[  160.318367] raw: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000[  160.327033] page dumped because: kasan: bad access detected[  160.333270][  160.334937] Memory state around the buggy address:[  160.356469] >ffff888116163800: fc ..
 漏洞公开时间：2024-05-21 23:15:24
 漏洞创建时间：2024-05-21 19:39:38
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-47393
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/76bbb482d33bfcd7e9070ecf594c9ec73e01c930 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a6c42ae1530f94724d3c42cf91fe3d3c5e394f8a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/aa85fb7bde558bb2e364e85976b14b259c8b6fe8 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e6fab7af6ba1bc77c78713a83876f60ca7a4a064 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47393 | https://bugzilla.suse.com/show_bug.cgi?id=1225321 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2021-47393 | https://bugzilla.suse.com/show_bug.cgi?id=1225321 |
| suse_bugzilla | https://git.kernel.org/stable/c/5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca | https://bugzilla.suse.com/show_bug.cgi?id=1225321 |
| suse_bugzilla | https://git.kernel.org/stable/c/76bbb482d33bfcd7e9070ecf594c9ec73e01c930 | https://bugzilla.suse.com/show_bug.cgi?id=1225321 |
| suse_bugzilla | https://git.kernel.org/stable/c/a6c42ae1530f94724d3c42cf91fe3d3c5e394f8a | https://bugzilla.suse.com/show_bug.cgi?id=1225321 |
| suse_bugzilla | https://git.kernel.org/stable/c/aa85fb7bde558bb2e364e85976b14b259c8b6fe8 | https://bugzilla.suse.com/show_bug.cgi?id=1225321 |
| suse_bugzilla | https://git.kernel.org/stable/c/e6fab7af6ba1bc77c78713a83876f60ca7a4a064 | https://bugzilla.suse.com/show_bug.cgi?id=1225321 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2021/CVE-2021-47393.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1225321 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2282345 | https://bugzilla.suse.com/show_bug.cgi?id=1225321 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024052147-CVE-2021-47393-ea1c@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2282345 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:5065 | https://bugzilla.redhat.com/show_bug.cgi?id=2282345 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2021-47393 | https://ubuntu.com/security/CVE-2021-47393 |
| ubuntu | https://git.kernel.org/linus/e6fab7af6ba1bc77c78713a83876f60ca7a4a064 (5.15-rc4) | https://ubuntu.com/security/CVE-2021-47393 |
| ubuntu | https://git.kernel.org/stable/c/5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca | https://ubuntu.com/security/CVE-2021-47393 |
| ubuntu | https://git.kernel.org/stable/c/a6c42ae1530f94724d3c42cf91fe3d3c5e394f8a | https://ubuntu.com/security/CVE-2021-47393 |
| ubuntu | https://git.kernel.org/stable/c/76bbb482d33bfcd7e9070ecf594c9ec73e01c930 | https://ubuntu.com/security/CVE-2021-47393 |
| ubuntu | https://git.kernel.org/stable/c/aa85fb7bde558bb2e364e85976b14b259c8b6fe8 | https://ubuntu.com/security/CVE-2021-47393 |
| ubuntu | https://git.kernel.org/stable/c/e6fab7af6ba1bc77c78713a83876f60ca7a4a064 | https://ubuntu.com/security/CVE-2021-47393 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2021-47393 | https://ubuntu.com/security/CVE-2021-47393 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2021-47393 | https://ubuntu.com/security/CVE-2021-47393 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2021-47393 | https://ubuntu.com/security/CVE-2021-47393 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2021-47393 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/e6fab7af6ba1bc77c78713a83876f60ca7a4a064 | https://git.kernel.org/linus/65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfsFan speed minimum can be enforced from sysfs. For example, settingcurrent fan speed to 20 is used to enforce fan speed to be at 100%speed, 19 - to be not below 90% speed, etcetera. This feature providesability to limit fan speed according to some system wiseconsiderations, like absence of some replaceable units or high systemambient temperature.Request for changing fan minimum speed is configuration request and canbe set only through  sysfs  write procedure. In this situation value ofargument  state  is above nominal fan speed maximum.Return non-zero code in this case to avoidthermal_cooling_device_stats_update() call, because in this casestatistics update violates thermal statistics table range.The issues is observed in case kernel is configured with optionCONFIG_THERMAL_STATISTICS.Here is the trace from KASAN:[  159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0[  159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444[  159.545625] Call Trace:[  159.548366]  dump_stack+0x92/0xc1[  159.552084]  ? thermal_cooling_device_stats_update+0x7d/0xb0[  159.635869]  thermal_zone_device_update+0x345/0x780[  159.688711]  thermal_zone_device_set_mode+0x7d/0xc0[  159.694174]  mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core][  159.700972]  ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core][  159.731827]  mlxsw_thermal_init+0x763/0x880 [mlxsw_core][  160.070233] RIP: 0033:0x7fd995909970[  160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ..[  160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001[  160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970[  160.111710] RDX: 0000000000000013 RSI: 0000000001906008 RDI: 0000000000000001[  160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700[  160.127687] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000013[  160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013[  160.143671][  160.145338] Allocated by task 2924:[  160.149242]  kasan_save_stack+0x19/0x40[  160.153541]  __kasan_kmalloc+0x7f/0xa0[  160.157743]  __kmalloc+0x1a2/0x2b0[  160.161552]  thermal_cooling_device_setup_sysfs+0xf9/0x1a0[  160.167687]  __thermal_cooling_device_register+0x1b5/0x500[  160.173833]  devm_thermal_of_cooling_device_register+0x60/0xa0[  160.180356]  mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan][  160.248140][  160.249807] The buggy address belongs to the object at ffff888116163400[  160.249807]  which belongs to the cache kmalloc-1k of size 1024[  160.263814] The buggy address is located 64 bytes to the right of[  160.263814]  1024-byte region [ffff888116163400, ffff888116163800)[  160.277536] The buggy address belongs to the page:[  160.282898] page:0000000012275840 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116167000 pfn:0x116160[  160.294872] head:0000000012275840 order:3 compound_mapcount:0 compound_pincount:0[  160.303251] flags: 0x200000000010200(slab|head|node=0|zone=2)[  160.309694] raw: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0[  160.318367] raw: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000[  160.327033] page dumped because: kasan: bad access detected[  160.333270][  160.334937] Memory state around the buggy address:[  160.356469] >ffff888116163800: fc ..
 openEuler评分：
  4.7
 Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

原因说明：
  1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):

src-openEuler/kernel
Closed

Content Risk Flag

Comments (60)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2021-47393

Comments (60)

Search

src-openEuler/kernel
Closed