CVE-2021-47544

一、漏洞信息
 漏洞编号：[CVE-2021-47544](https://nvd.nist.gov/vuln/detail/CVE-2021-47544)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:tcp: fix page frag corruption on page faultSteffen reported a TCP stream corruption for HTTP requestsserved by the apache web-server using a cifs mount-pointand memory mapping the relevant file.The root cause is quite similar to the one addressed bycommit 20eb4f29b602 ( net: fix sk_page_frag() recursion frommemory reclaim ). Here the nested access to the task page fragis caused by a page fault on the (mmapped) user-space memorybuffer coming from the cifs file.The page fault handler performs an smb transaction on a differentsocket, inside the same process context. Since sk->sk_allactionfor such socket does not prevent the usage for the task_frag,the nested allocation modify  under the hood  the page fragin use by the outer sendmsg call, corrupting the stream.The overall relevant stack trace looks like the following:httpd 78268 [001] 3461630.850950:      probe:tcp_sendmsg_locked:        ffffffff91461d91 tcp_sendmsg_locked+0x1        ffffffff91462b57 tcp_sendmsg+0x27        ffffffff9139814e sock_sendmsg+0x3e        ffffffffc06dfe1d smb_send_kvec+0x28        [...]        ffffffffc06cfaf8 cifs_readpages+0x213        ffffffff90e83c4b read_pages+0x6b        ffffffff90e83f31 __do_page_cache_readahead+0x1c1        ffffffff90e79e98 filemap_fault+0x788        ffffffff90eb0458 __do_fault+0x38        ffffffff90eb5280 do_fault+0x1a0        ffffffff90eb7c84 __handle_mm_fault+0x4d4        ffffffff90eb8093 handle_mm_fault+0xc3        ffffffff90c74f6d __do_page_fault+0x1ed        ffffffff90c75277 do_page_fault+0x37        ffffffff9160111e page_fault+0x1e        ffffffff9109e7b5 copyin+0x25        ffffffff9109eb40 _copy_from_iter_full+0xe0        ffffffff91462370 tcp_sendmsg_locked+0x5e0        ffffffff91462370 tcp_sendmsg_locked+0x5e0        ffffffff91462b57 tcp_sendmsg+0x27        ffffffff9139815c sock_sendmsg+0x4c        ffffffff913981f7 sock_write_iter+0x97        ffffffff90f2cc56 do_iter_readv_writev+0x156        ffffffff90f2dff0 do_iter_write+0x80        ffffffff90f2e1c3 vfs_writev+0xa3        ffffffff90f2e27c do_writev+0x5c        ffffffff90c042bb do_syscall_64+0x5b        ffffffff916000ad entry_SYSCALL_64_after_hwframe+0x65The cifs filesystem rightfully sets sk_allocations to GFP_NOFS,we can avoid the nesting using the sk page frag for allocationlacking the __GFP_FS flag. Do not define an additional mm-helperfor that, as this is strictly tied to the sk page frag usage.v1 -> v2: - use a stricted sk_page_frag() check instead of reordering the   code (Eric)
 漏洞公开时间：2024-05-24 23:15:18
 漏洞创建时间：2024-05-24 18:34:02
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-47544
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5a9afcd827cafe14a95c9fcbded2c2d104f18dfc |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c6f340a331fb72e5ac23a083de9c780e132ca3ae |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/dacb5d8875cc6cd3a553363b4d6f06760fcbe70c |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47544 | https://bugzilla.suse.com/show_bug.cgi?id=1225463 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2021-47544 | https://bugzilla.suse.com/show_bug.cgi?id=1225463 |
| suse_bugzilla | https://git.kernel.org/stable/c/5a9afcd827cafe14a95c9fcbded2c2d104f18dfc | https://bugzilla.suse.com/show_bug.cgi?id=1225463 |
| suse_bugzilla | https://git.kernel.org/stable/c/c6f340a331fb72e5ac23a083de9c780e132ca3ae | https://bugzilla.suse.com/show_bug.cgi?id=1225463 |
| suse_bugzilla | https://git.kernel.org/stable/c/dacb5d8875cc6cd3a553363b4d6f06760fcbe70c | https://bugzilla.suse.com/show_bug.cgi?id=1225463 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2021/CVE-2021-47544.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1225463 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2283406 | https://bugzilla.suse.com/show_bug.cgi?id=1225463 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024052440-CVE-2021-47544-ceb5@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2283406 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2021-47544 | https://ubuntu.com/security/CVE-2021-47544 |
| ubuntu | https://git.kernel.org/linus/dacb5d8875cc6cd3a553363b4d6f06760fcbe70c (5.16-rc4) | https://ubuntu.com/security/CVE-2021-47544 |
| ubuntu | https://git.kernel.org/stable/c/5a9afcd827cafe14a95c9fcbded2c2d104f18dfc | https://ubuntu.com/security/CVE-2021-47544 |
| ubuntu | https://git.kernel.org/stable/c/c6f340a331fb72e5ac23a083de9c780e132ca3ae | https://ubuntu.com/security/CVE-2021-47544 |
| ubuntu | https://git.kernel.org/stable/c/dacb5d8875cc6cd3a553363b4d6f06760fcbe70c | https://ubuntu.com/security/CVE-2021-47544 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2021-47544 | https://ubuntu.com/security/CVE-2021-47544 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2021-47544 | https://ubuntu.com/security/CVE-2021-47544 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2021-47544 | https://ubuntu.com/security/CVE-2021-47544 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2021-47544 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/dacb5d8875cc6cd3a553363b4d6f06760fcbe70c | https://git.kernel.org/linus/5640f7685831e088fe6c2e1f863a6805962f8e81 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:tcp: fix page frag corruption on page faultSteffen reported a TCP stream corruption for HTTP requestsserved by the apache web-server using a cifs mount-pointand memory mapping the relevant file.The root cause is quite similar to the one addressed bycommit 20eb4f29b602 ( net: fix sk_page_frag() recursion frommemory reclaim ). Here the nested access to the task page fragis caused by a page fault on the (mmapped) user-space memorybuffer coming from the cifs file.The page fault handler performs an smb transaction on a differentsocket, inside the same process context. Since sk->sk_allactionfor such socket does not prevent the usage for the task_frag,the nested allocation modify  under the hood  the page fragin use by the outer sendmsg call, corrupting the stream.The overall relevant stack trace looks like the following:httpd 78268 [001] 3461630.850950:      probe:tcp_sendmsg_locked:        ffffffff91461d91 tcp_sendmsg_locked+0x1        ffffffff91462b57 tcp_sendmsg+0x27        ffffffff9139814e sock_sendmsg+0x3e        ffffffffc06dfe1d smb_send_kvec+0x28        [...]        ffffffffc06cfaf8 cifs_readpages+0x213        ffffffff90e83c4b read_pages+0x6b        ffffffff90e83f31 __do_page_cache_readahead+0x1c1        ffffffff90e79e98 filemap_fault+0x788        ffffffff90eb0458 __do_fault+0x38        ffffffff90eb5280 do_fault+0x1a0        ffffffff90eb7c84 __handle_mm_fault+0x4d4        ffffffff90eb8093 handle_mm_fault+0xc3        ffffffff90c74f6d __do_page_fault+0x1ed        ffffffff90c75277 do_page_fault+0x37        ffffffff9160111e page_fault+0x1e        ffffffff9109e7b5 copyin+0x25        ffffffff9109eb40 _copy_from_iter_full+0xe0        ffffffff91462370 tcp_sendmsg_locked+0x5e0        ffffffff91462370 tcp_sendmsg_locked+0x5e0        ffffffff91462b57 tcp_sendmsg+0x27        ffffffff9139815c sock_sendmsg+0x4c        ffffffff913981f7 sock_write_iter+0x97        ffffffff90f2cc56 do_iter_readv_writev+0x156        ffffffff90f2dff0 do_iter_write+0x80        ffffffff90f2e1c3 vfs_writev+0xa3        ffffffff90f2e27c do_writev+0x5c        ffffffff90c042bb do_syscall_64+0x5b        ffffffff916000ad entry_SYSCALL_64_after_hwframe+0x65The cifs filesystem rightfully sets sk_allocations to GFP_NOFS,we can avoid the nesting using the sk page frag for allocationlacking the __GFP_FS flag. Do not define an additional mm-helperfor that, as this is strictly tied to the sk page frag usage.v1 -> v2: - use a stricted sk_page_frag() check instead of reordering the   code (Eric)
 openEuler评分：
  6.1
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):不受影响
3.openEuler-22.03-LTS-SP4(5.10.0):不受影响
4.master(6.6.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

src-openEuler / kernel
Closed

Content Risk Flag

Comments (36)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2021-47544

Comments (36)

Search

src-openEuler / kernel
Closed