CVE-2021-47544: tcp: fix page frag corruption on page fault
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix page frag corruption on page fault
Steffen reported a TCP stream corruption for HTTP requests served by the apache web-server using a cifs mount-point and memory mapping the relevant file.
The root cause is quite similar to the one addressed by commit 20eb4f29b602 ("net: fix skpagefrag() recursion from memory reclaim"). Here the nested access to the task page frag is caused by a page fault on the (mmapped) user-space memory buffer coming from the cifs file.
The page fault handler performs an smb transaction on a different socket, inside the same process context. Since sk->skallaction for such socket does not prevent the usage for the taskfrag, the nested allocation modify "under the hood" the page frag in use by the outer sendmsg call, corrupting the stream.
The overall relevant stack trace looks like the following:
httpd 78268 [001] 3461630.850950: probe:tcpsendmsglocked: ffffffff91461d91 tcpsendmsglocked+0x1 ffffffff91462b57 tcpsendmsg+0x27 ffffffff9139814e socksendmsg+0x3e ffffffffc06dfe1d smbsendkvec+0x28 [...] ffffffffc06cfaf8 cifsreadpages+0x213 ffffffff90e83c4b readpages+0x6b ffffffff90e83f31 dopagecachereadahead+0x1c1 ffffffff90e79e98 filemapfault+0x788 ffffffff90eb0458 dofault+0x38 ffffffff90eb5280 dofault+0x1a0 ffffffff90eb7c84 handlemmfault+0x4d4 ffffffff90eb8093 handlemmfault+0xc3 ffffffff90c74f6d dopagefault+0x1ed ffffffff90c75277 dopagefault+0x37 ffffffff9160111e pagefault+0x1e ffffffff9109e7b5 copyin+0x25 ffffffff9109eb40 copyfromiterfull+0xe0 ffffffff91462370 tcpsendmsglocked+0x5e0 ffffffff91462370 tcpsendmsglocked+0x5e0 ffffffff91462b57 tcpsendmsg+0x27 ffffffff9139815c socksendmsg+0x4c ffffffff913981f7 sockwriteiter+0x97 ffffffff90f2cc56 doiterreadvwritev+0x156 ffffffff90f2dff0 doiterwrite+0x80 ffffffff90f2e1c3 vfswritev+0xa3 ffffffff90f2e27c dowritev+0x5c ffffffff90c042bb dosyscall64+0x5b ffffffff916000ad entrySYSCALL64afterhwframe+0x65
The cifs filesystem rightfully sets skallocations to GFPNOFS, we can avoid the nesting using the sk page frag for allocation lacking the GFPFS flag. Do not define an additional mm-helper for that, as this is strictly tied to the sk page frag usage.
v1 -> v2: - use a stricted skpagefrag() check instead of reordering the code (Eric)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 20eb4f29b602 - Configuration
Adjust TCP page-flag/fragment handling per the change described: use a stricter sk_page_frag() check instead of reordering, and avoid creating an additional mm-helper/nested allocation by using sk page frag for allocation (v1 -> v2).
Linux kernel networking sk_page_frag() allocation/check behavior = use a stricted sk_page_frag() check instead of reordering the; avoid nested allocation by using the sk page frag for allocation (v1 -> v2 avoids nesting)
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47544?
CVE-2021-47544 has been classified with a medium severity level due to its potential to corrupt TCP streams, impacting HTTP requests.
How do I fix CVE-2021-47544?
To fix CVE-2021-47544, update your Linux kernel to the latest stable version that includes the resolution for this vulnerability.
Which Linux kernel versions are affected by CVE-2021-47544?
CVE-2021-47544 affects Linux kernel versions between 3.7 and 5.10.84 and also includes versions in the 5.11 to 5.15.7 range.
What type of issue does CVE-2021-47544 address?
CVE-2021-47544 addresses a TCP stream corruption issue that can occur when handling HTTP requests via a CIFS mount-point.
Is CVE-2021-47544 specific to any software besides the Linux kernel?
Yes, CVE-2021-47544 can also impact the Apache HTTP Server when it processes TCP streams that are affected by this vulnerability.