CVE-2021-46984: kyber: fix out of bounds access when preempted
In the Linux kernel, the following vulnerability has been resolved:
kyber: fix out of bounds access when preempted
blkmqschedbiomerge() gets the ctx and hctx for the current CPU and passes the hctx to ->biomerge(). kyberbiomerge() then gets the ctx for the current CPU again and uses that to get the corresponding Kyber context in the passed hctx. However, the thread may be preempted between the two calls to blkmqgetctx(), and the ctx returned the second time may no longer correspond to the passed hctx. This "works" accidentally most of the time, but it can cause us to read garbage if the second ctx came from an hctx with more ctx's than the first one (i.e., if ctx->indexhw[hctx->type] > hctx->nrctx).
This manifested as this UBSAN array index out of bounds error reported by Jakub:
UBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9 index 13106 is out of range for type 'long unsigned int [128]' Call Trace: dumpstack+0xa4/0xe5 ubsanepilogue+0x5/0x40 ubsanhandleoutofbounds.cold.13+0x2a/0x34 queuedspinlockslowpath+0x476/0x480 dorawspinlock+0x1c2/0x1d0 kyberbiomerge+0x112/0x180 blkmqsubmitbio+0x1f5/0x1100 submitbionoacct+0x7b0/0x870 submitbio+0xc2/0x3a0 btrfsmapbio+0x4f0/0x9d0 btrfssubmitdatabio+0x24e/0x310 submitonebio+0x7f/0xb0 submitextentpage+0xc4/0x440 extentwritepageio+0x2b8/0x5e0 extentwritepage+0x28d/0x6e0 extentwritecachepages+0x4d7/0x7a0 extentwritepages+0xa2/0x110 dowritepages+0x8f/0x180 writebacksingleinode+0x99/0x7f0 writebacksbinodes+0x34e/0x790 writebackinodeswb+0x9e/0x120 wbwriteback+0x4d2/0x660 wbworkfn+0x64d/0xa10 processonework+0x53a/0xa80 workerthread+0x69/0x5b0 kthread+0x20b/0x240 retfromfork+0x1f/0x30
Only Kyber uses the hctx, so fix it by passing the requestqueue to ->biomerge() instead. BFQ and mq-deadline just use that, and Kyber can map the queues itself to avoid the mismatch.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
kyber: fix out of bounds access when preempted
The Linux kernel CVE team has assigned CVE-2021-46984 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024022824-CVE-2021-46984-e55e@gregkh/T/#u
— Red Hat
Linux Kernel could allow a local attacker to obtain sensitive information, caused by an out-of-bounds read flaw when preempted. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.120 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.38 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.11.22 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.12.5 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2021-46984 - Configuration
In the Linux kernel Kyber implementation (kyber_bio_merge()/__blk_mq_sched_bio_merge() path), fix the out-of-bounds read flaw by passing the request_queue to avoid using a potentially mismatched current CPU ctx/hctx when the thread is preempted.
Linux kernel kyber bio merge blk_mq_get_ctx() usage in kyber_bio_merge()/__blk_mq_sched_bio_merge() path = Pass the request_queue to the kyber hctx handling so the ctx/hctx cannot mismatch when preempted
Event History
Frequently Asked Questions
What is the severity of CVE-2021-46984?
CVE-2021-46984 has a moderate severity rating due to the potential for out of bounds access in the Linux kernel.
How do I fix CVE-2021-46984?
To fix CVE-2021-46984, you should upgrade to kernel versions 5.4.120, 5.10.38, 5.11.22, 5.12.5, or 5.13.
Which versions of the Linux kernel are affected by CVE-2021-46984?
CVE-2021-46984 affects Linux kernel versions prior to 5.4.120, 5.10.38, 5.11.22, 5.12.5, and 5.13.
What type of vulnerability is CVE-2021-46984?
CVE-2021-46984 is an out of bounds access vulnerability that can occur when the kyber scheduler is preempted.
Is it safe to continue using versions of the Linux kernel affected by CVE-2021-46984?
Continuing to use affected versions of the Linux kernel poses security risks, and it is recommended to apply the patches as soon as possible.